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PREFACE 


The author has spent several years writing this book. Many hours have 
been spent, writing, re-writdng, and correcting, always attempting to 
insure that the material presented is readable, easy to understand, and 
especially, that the contents are cryptanalytically correct. Many hours, 
too, were spent preparing and checking the numerous problems that accomp¬ 
any most of the chapters. The problems not only will hopefully provide 
the reader with "many hours of enjoyment", but also will serve to re¬ 
inforce in the reader's mind the knowledge learned; for after all, there 
is no better way to learn than by doing! Thus, the reader should con¬ 
scientiously attempt to solve at least several of the problems at the end 
of each chapter. By the time the last chapter is finished, the reader then 
should indeed have a good knowledge of the cryptanalysis of the HAGELIN 
CRYPTOGRAPH system. 

As the reader will quickly find, even after the first chapter, the 
HAGELIN CRYPTOGRAPH system is a fascinating problem for the cryptanalyst. 
There are a number of different facets in the cryptanalytic solution of 
the HAGELIN CRYPTOGRAPH, some simple, and some deeply complicated. 
Unfortunately for the amateur cryptanalyst, the practical analysis of 
HAGELIN CRYPTOGRAPHIC "traffic" probably requires the use of a modern 
computer. Nonetheless, however, there is still much that can be done 
simply with a piece of paper and a pencil to solve the system. 

The author has been assisted by a number of persons in the preparation 
of this book. Some provided constructive comments, others checked pages, 
and some prepared enciphered messages for the author to analyze, solve, 
etc. Especially, the author would like to give thanks to Cipher Deavours, 
Brian Winkel, Herb Baruch, Louis Kruh, and Greg Mellen, each, incidentally, 
an outstanding cryptanalyst in his own right, for their kind help. Thanks, 
too, should go to David G. Cantor of the University of California, Los 
Angeles, and William F. Donoghue, Jr. of the University of California, 
Irvine, for their help with respect to a mathematical problem concerning 
the indicators of the HAGELIN CRYPTOGRAPH. A special thanks, also, must 
go to Roger Stuart Brown, not only a fine medical doctor, but also an 
astute cryptologist, for his particular assistance with respect to the 
HAGELIN CRYPTOGRAPH, Model Type CD-57, the subject of Chapter 10. 


V 


Finally, any errors that might have inadvertently occurred, hopefully 
there will not be many, are those of the author; and readers, of course, 
are encouraged to provide comments to the author regarding the material 
presented. It is the author's sincere hope that this book will contribute 
something to the science of cryptology, and that readers will find hours 
of enjoyment as they study the cryptanalysis of the HAGELIN CRYPTOGRAPH. 


Mission Viejo, 
California, 1977 


WGB 


INTRODUCTION 


The HAGELIN CRYPTOGRAPH was invented in the 1930*s, just before World 
War II, by a creative genius, Boris Hagelin, then of Stockholm, Sweden. Of 
the many **cryptographic machines" that have appeared on the cryptographic 
scene in the last 40 to 50 years, none have been "accepted" like the HAGELIN 
CRYPTOGRAPH. Indeed, the HAGELIN CRYPTOGRAPH stands alone, well above all 
others, when it comes to "favorable reception" by governments for their own 
secret communications! Even today, it is probable that the HAGELIN finds 
active use in many countries for both military and diplomatic communications. 
It would be hard to estimate in numbers "how many" Hagelin machines have 
actually been produced since Boris Hagelin made his first prototype machine. 
Perhaps as many as 500,000 machines! In any case, it can be said that many 
thousands of these cryptographs have been manufactured; and at the present 
time the HAGELIN CRYPTOGRAPH is manufactured and marketed by a very reputable 
Swiss firm: Crypto Aktiengesellschaft, 10 Weinbergstrasse, Zug, Switzerland. 

In its original form the HAGELIN CRYPTOGRAPH was a light-weight, compact, 
hand-operated mechanical device used for the encipherment and decipherment 
of messages. Shortly thereafter the output of the cryptographic machine 
was made to print on a gummed tape with the ciphertext conveniently divided 
into five-letter groups and the plaintext in normal word-lengths, the latter 
accomplished by using the letter "z" as a spacer between words. 

Since development of the first HAGELIN CRYPTOGRAPH, then designated as the 
Model Type C-36 machine, with five keywheels and fixed lugs, a number of 
newer and so-called improved models have been produced. 

Historically — in the United States the HAGELIN CRYPTOGRAPH is probably 
best known as the U.S. Army's Converter M-209 or the U.S. Navy's CSP-1500. 
Both similar, these drab-green versions of the HAGELIN designated Model Type 
C-48 cipher machine, used during World War II, contained 54 movable lugs, 
two lugs on each of 27 lug-bars, and six keywheels having respectively 26, 

25, 23, 21, 19, and 17 pins. 

More recent and improved versions of the HAGELIN CRYPTOGRAPH are electri¬ 
cal, rather than mechanical, and contain keyboards to make encipherment and 
decipherment operations easier for "cryptographic clerks". Thus, for example, 
the older Model Type C-48 cipher machine has been replaced by the HAGELIN 
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Chapter 1 


THE CRYPTOGRAPHIC PROCESS 

When the HAGELIN CRYPTOGRAPH is actually used, encipherment and 
decipherment processes are performed, of course, mechanically "by the 
machine". For the purpose of cryptanalysis, however, we must consider 
the equivalent "on paper" processes of the cryptographic machine. 

Essentially, during encipherment a generated key is applied to plaintext 
in order to obtain resultant ciphertext; and during decipherment the same 
generated key is applied to the ciphertext in order to obtain the original 
plaintext. 

In the cryptographic processes of the HAGELIN CRYPTOGRAPH there are, 
thus, three elements to be considered: 

(1) Plaintext. 

(2) Ciphertext. 

(3) Key. 

Given any two elements^ the third element may be found! 

Thus — 

(1) During encipherment, plaintext enciphered with key results in 
ciphertext. 

(2) During decipheirment, given the ciphertext and key, plaintext is 

found. 

(3) And important from the viewpoint of the cryptanalyst, given 
ciphertext with the plaintext known, the key may be recovered. 

Let us examine now the method by which the three elements, plaintext, 
ciphertext, and key, cohere. 

The important tableau of Figure 1, known historically to the cryptographer 
as a Beaufort Tableau, provides the "relationship" between ciphertext, 
plaintext, and key in the HAGELIN CRYPTOGRAPH system. 

The student should note that the key is a numerical key composed of the 
numbers 0 thru 27; and he should note, too, that the numbers 1 and 27 are 
equivalent, as are the numbers 0 and 26. 
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KEY 


HAGELIN TABLEAU 

Beaufort Tableau for the Type C-48 Cipher Device (M-209) 
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In the problems following this chapter the student will gain 
proficiency in the use of the Hagelin Tableau of Figure 1, 

One special note is important, however, which concerns plaintext 
enciphered with the HAGELIN CRYPTOGRAPH. In order to obtain **spacing" 
between words - making the plaintext more easily readable - the HAGELIN 
CRYPTOGRAPH is designed so that the plaintext letter Z prints as a space. 
Thus, for example, in the HAGELIN CRYPTOGRAPH system, to the cryptanalyst 
plaintext might appear as follows: 

HELPZNEEDEDZONZHILLZSIXZONEZZEROZZERO 

But the same text, using the HAGELIN CRYPTOGRAPH, will print on 
gummed tape as: 

HELP NEEDED ON HILL SIX ONE ERO ERO 

Note that when the letter Z actually does occur in the message text, it 
appears as a space and must be read into the text. 

Therefore, in the following problems, keep in mind that the letter Z 
acts as a space between words. 


PROBLEMS 


1. Given the keying sequence "5 26 12 19 0 27 6 5 0 21 8 4 0 5 13", 
decipher the following message: 

NVSYI NGLLV GDHAN. 

2. Given the key "06600060600660606606", decipher the 
following message: 

ULOMR HYAXM URONF. GXRMG. 

3. Given the plaintext "SEND MORE SUPPLIES", recover the key used to 
encipher the following message: 

HDMWI NTIDI HNKSO ZDPAI. 

4. It is believed that the following ciphertext message begins with the 
word "REPEAT". Can you read the message? 

IVKVZ GAOZH GANVH HZTVA. 
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5. The following two messages have been enciphered with the same 
key. The first message begins with the word "PLEASE". Read 
both messages. 

No.l- KUBZN BAHBM CASVU KGAGA. 

No. 2- ZTTFS XGRRM GRHAN SR IMA. 

6. The following three messages have been enciphered with the same 
key. Message No. 2 is known to begin with the word "CONTACT". 
Read the messages. 

No.l- PBJSI THAFE SRPBW GMJAW 

Z E Z R 0. 

No.2- XRAOH LGAUT VGIJR MGIVA 

V V J G 0. 

No. 3- LSJIH FIXOH IGIUL NUIGZ 

W H J G 0. 


7. The following message has been enciphered with a keying sequence 
which repeats every 17 letters. The message is known to begin 
with the word "ENEMY". Read the message. 

VWFNB KUVSH VRAJI VKIFQ IVJGB 
WDANV KZIFA BWATV LGKRS JKFAA. 
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This message, like the previous message, has been enciphered with 
a keying sequence which repeats every 17 letters. The message 


begins with the word "RESCUE". Read the message. 
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9. 


The following three messages have been enciphered with the same 
key. The first message begins with the plaintext word "NEED". 
Read the messages. 


No. 1 
No. 2 


M X V B D 
H X M B D 
I X K Q L 
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N N L V F 
G C U H F 
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Q E A F C. 
T J R Q O. 
T H V F C. 


No. 3 
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10. The following messages have been enciphered with the same keying 


sequence. 

Message No. 
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with the word 

*'T0’ 

II 
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used as 
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Chapter 2 


ANALYSIS OF A SINGLE-WHEEL HAGELIN CRYPTOGRAPH 

The cryptographic security basically inherent in the HAGELIN CRYPTOGRAPH 
system is provided principally by the manner in which key is generated. 

Though the actual HAGELIN CRYPTOGRAPH consists of a number of wheels, 
most often six, each of which contributes normally its part to the final 
generated key, for the purpose of introducing the student to the principle 
behind "key generation" in the HAGELIN CRYPTOGRAPH, we shall consider in 
this chapter a keying sequence being generated by a single wheel. 

The student should understand, however, that though a single-wheel 
HAGELIN CRYPTOGRAPH system is somewhat "mythical", in that it is very 
unlikely that such a system would actually be encountered, such a system 
is within the realm of possibility and can in fact be duplicated with any 
HAGELIN CRYPTOGRAPH by merely putting the remaining wheels in a non- 
effective condition. 

Each wheel of the HAGELIN CRYPTOGRAPH is of given length; or to put it 
another way, each wheel has a given number of pin positions. As letters 
are enciphered (or deciphered), the wheels simultaneously revolve step- 
by-step, one position to the next. Thus, a wheel, for example, having 
17 positions, or pins, after encipherment of 17 letters will have returned 
to its original position. 

Two mechanical variables affect key generation in the HAGELIN CRYPTOGRAPH 
system, lug-settings and pin-settings; and these variables are set on wheels 
before encipherment (or decipherment) by the cryptographic clerk. 

First, a number of lugs may be made effective for each wheel. The number 
of lugs set on a wheel may be one, two, three, or even twelve, thirteen, 
etc. If no lugs are set on a wheel, the wheel will be in a non-effective 
condition. 

Second, each position of a wheel may be made effective or non-effective 
by pushing a pin to the right or to the left. If a pin is pushed to the 
left, the position becomes non-effective; if a pin is pushed to the right, 
the position becomes effective. 
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When a position on the wheel is effective, when its "pin" is to the 
right, the key generated by the wheel will be equal to the number of "lugs" 
set on the wheel. When a position on the wheel is non-effective, the key 
will be 0. Thus, for example, the key generated from a wheel of 17 positions 
might look as follows: 

08880080808008808088800808. . .etc. 

It can be seen that in this generated keying sequence the number of "lugs" 
set on the wheel is eight; that in the first position, the "pin" is in a 
non-effective position; that in the next three positions, the "pins" are 
effective, etc. After 17 numbers of key, the keying sequence, of course, 
repeats. 

Cryptanalysis of a single-wheel HAGELIN CRYPTOGRAPH system is rather easy, 
for the generated keying sequence always consists of a combination of but two 
numbers, one of the numbers being 0, representing a "pin" in a non-effective 
position. 

Consider, for example, the cryptanalysis of the following message known 
to be enciphered with a single-wheel: 

YVXLM GALUV CGXAN PFVQR WACVN 

LHHPI BAWBA XGBKA WYZCH DRWGH 

CTAPG AMHJS WAQAA. 

As the message has been enciphered with a single-wheel, we know that the 
generated keying sequence consists of the number 0 plus one other number. 

We might use a "trial-and-error" method, and simply assume what the other 
number might be; but there might be an easier method to determine the other 
number. 

Since the letter Z is used in the HAGELIN CRYPTOGRAPH method as a "spacer" 
between words, we might consider also the final group of the message. In 
order to complete the last five-letter group of the message, is it possible 
that the letter Z was used as a null? 

Let us therefore examine the last group of the message, and make the 
assumption that the message ends with one or more Z*s: 

ciphertext: WAQAA 
assumed plaintext: Z Z Z Z Z 
resulting key: 22 0 16 0 0 
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We may disregard the ciphertext letter W, for it probably represents 
the last letter of the message; but the last four letters appear 
likely to represent Z*s. Further, it appears that the generated key 
probably consists of the numbers 0 and 16. 

Let us, therefore, attempt to read the message, assuming that the 
**lug setting*' for the wheel is 16. 

For the first 20 letters of ciphertext, let us examine the plaintext 
possibilities: 


Ciphertext: YVXLMGALUVCGXANPFVQR 

If key is 0, plaintext is: BECONTZOFEXTCZMKUEJI 
If key is 16, plaintext is: RUSEDWPEVUNKSPCAKUZY 

Within these possibilities, can plaintext be read? The letter Z, 
used as a "spacer" between words, proves especially valuable to separate 
potential words: 


BECONTZOFEXTCZMKUEJI 

RUSEDWPEVUNKSPCAKUZY 


yields 


B E C O N T 
R U S E D W 


0 F E X T C 
E V U N K S 


M K U E 
C A K U 


I 

Y 


And the plaintext is evident: 


B E C O N T 
R U S E D W 


RECENT 


O F E X T C 

E V U N K Z 
or 

EVENTS 


M K U E Z 
C A K U Y 


MAKE I(T) 


In the problems that follow, messages can be analyzed in similar 
fashion. Where the last group does not reveal the unknown "other" 
number of the generated key, the solver can fall back on the "trial- 
and-error" method of testing the limited number of "other" numbers 
possible. 


PROBLEMS 


11. The following two messages contain the same plaintext, but have 

been enciphered with different "wheel settings". Read the messages. 
No.l-TBHNZ ZVANX IGMRG MBDHG HBMAG 

NO.2-UV0HG TVHHR JHTLH MCKHA IVNHH 
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12 . 


14. 


15. 


16, 


19. 


20, 


The following messages have been enciphered using the same keying 
sequence. Read the messages. 

No. 1- WVLJR SVWAU DZALZ HJHAZ lAGFI 
JVAUL WZPAO. 


No. 2 - Y O J N H 
P 0 H T K 
V K A A A. 


J A Z W S 
K L W G 0 


R V V O R 
D F 0 O 0 


U O Z I U 
Y V 0 I F 


F O 0 J I 
I A R V G 


13. Solve the following cryptogram: 


I H 

T 

F 

A 

G 

T 

A 

L 

R 

I 

M 

K 

E 

L 

G 

X 

T 

U 

Z 

W 

s 

N 

M 

L 

Q V 

U 

A 

E 

R 

0 

A 

A 

S 

D 

V 

A 

E 

H 

A 

E 

F 

Y 

I 

I 

H 

W 

M 

R 

Y W 

R 

J 

Z 

S 

V 

A 

H 

M 

H 

N 

N 

A 

E 

L 

H 

M 

K 

R 

0 

A 

V 

W 

M 


Y L X P M. 

Read the following message: 

QVKKZ TYAXL FLGYY 
CHJDN VKHCT VDADD. 


M A L V N 


Solve the following: 

TVVLT GAKOZ 


17. 


18. 


Read the following cryptogram: 

LLFXQ TLRVO FHSRL 

LADZM VFAFF. 

Read the following message: 

OLCJR VMANU CIZMP 

Solve the following: 

KPABL RNDMW VMXEL 

LGACZ KKZSV LQEZQ 

TDKRI ZAEAE. 

Read the following message: 

GTWIW BSAIB YW 

WBLVA ORMWH BS 

The following messages contain 
different. Read the messages. 
No.l- ULAFZ PFZWG 

No. 2- POAAZ KICOJ 


Y Y R B Z 
H H V M A 


Y C G D 0 


ACMFL INKRR WXALA. 


SFNVL FNRAL 


JCSXK VCAAC. 


I E U V I 
R L A Q Z 


V N 

A 

M M A 

W F 

R X 

W M 

Y 

M B 

M 

F J B 

I V 

Y G 

M I 

A. 

the 

same text 

/ but 

keys 

are 



Z V P I G 
R V K A J 


T W H B A. 
0 W Z E D. 
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Chapter 3 


ANALYSIS OF A TWO-WHEEL HAGELIN CRYPTOGRAPH 

Let us consider in this chapter the analysis of a two-wheel HAGELIN 
CRYPTOGRAPH system. While it is true that a two-wheel HAGELIN CRYPTOGRAPH 
system, like that of a single-wheel HAGELIN CRYPTOGRAPH system, is not 
likely to be actually encountered, such a system is not an absolute 
impossibility, for it can be duplicated using the HAGELIN CRYPTOGRAPH 
with the remaining wheels in a non-effective condition. The remaining 
wheels may be put in a non-effective condition by either: 

(1) putting all pins of the remaining wheels to the left, their 
non-effective position, or 

(2) by failing to put lugs on the remaining wheels. 

To introduce the student to the principle of a keying sequence being 
generated from more than one wheel, consider a single wheel of length 
17 which produces, for example, the key "202022020202202 
2 0". At the same time, consider a second wheel, this one of length 
19, which produces, for example, the key "030330030333003 
0303 ". 

In a two-wheel HAGELIN CRYPTCX3RAPH system, these two wheels, each of 
different length, can combine to generate a resultant keying sequence as 
follows: 

Key #1: 20202202020220220/20202202020 

Key #2: 0303300303330030303/030330030 

Resultant key: 2323520505352052323232532050 

220220 / 20202202020220220 / 20 . . . 

3330030303/030330030333003 . . . 

5532232323250532052355023 etc. 

Note that the resultant key consists of four different niombers, 0, 2, 

3, and 5, the latter 5 resulting from the sum of 2 and 3. 

We can say, then, that where a two-wheel HAGELIN system is used in this 
fashion, the resultant, generated key will consist of four numbers, 0, X/ 

and _z, where x Y = 

It should be noted, too, that the resultant keying sequence will 
itself not repeat until the "lowest common multiple" of the lengths of the 
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two wheels is reached, in this case 323 letters, the "lowest common 
multiple" of 17 and 19. 

Let us turn to the analysis of a cryptogram produced from a keying 
sequence generated from two wheels in the above fashion. To make our 
analysis simpler, let us say, too, that the message is known to begin 
with the word "TO". 

QPGDV WVIJO KHTBK SGLXM ANVFW 
WZCAE LPOAT BOUFW KMHVA RXLNR 
W Z E A G. 


Knowing that the first word of the message is "TO" enables us to 
easily recover the first three numbers of the keying sequence: 

Plaintext: T 0 Z 

Ciphertext: Q P G 

Recovered key: 10 4 6 

The recovered key, 10 4 6, at this point looks good; for the three 
numbers have the favorable property that 4 + 6 = 10. Indeed, with the 
known 0 in the keying sequence, we probably know all four of the numbers 
which comprise the resultant, generated key: 0, 4, 6, and 10. 

With the four numbers of the keying sequence probably identified, the 
four possible plaintext equivalents for each ciphertext letter may be 
placed beneath the letters of the cryptogram: 


QPGDVWVIJOKHTBKSGLXMANVFWWZCAELPOA 

0: JKTWEDERQLPSGYPHTOCNZMEUDDAXZVOKLZ 
4: NOXAIHIVUPTWKCTLXSGRDQIYHHEBDZSOPD 
6: PQZCKJKXWRVYMEVNZUITFSKAJJGDFBUQRF 
10: TUDGONOBAVZCQIZRDYMXJWOENNKHJFYUVJ 


TBOUFWKMHVARXLNRWZEAG . 

0: GYLFUDPNSEZICOMIDAVZT 
4: KCPJYHTRWIDMGSQMHEZDX 
6: MERLAJVTYKFOIUSOJGBFZ 
10: QIVPENZXCOJSMYWSNKFJD 

At this point, assuming the four key numbers to be correct, a successful 
solution is fairly well assured. 


Again, the plaintext letter Z, the "spacer" between words, is 
to identify word lengths, though some Z*s may occur by accident. 


valuable 
Thus, 


11 







locations of Z's are identified in coliimns: 


qpgdvwvijokhtbksglxmanvfwwzcaelpoa 

0;JKTWEDERQLPSGYPHTOCN£MEUDDAX^VOKLZ 

4:NOXAIHIVUPTWKCTLXSGRDQiyHHEBFzSOPD 

6:PQ£CKJKXWRVYMEVN^UITFSKAJJGDFb'uQRF 

10:TUDGONOBAV^CQI£RDYMXJWOENNKHJFYUVJ 

TBOUFWKMHVARXLNRWZEAG . 

0‘ GYLFUDPNSE^ICOMIDAVZT 

4: KCPJYHTRWIDMGSQMHEZDX 
6: MERLAJVTYKFOIUSOJGBF^ 

10: QIVPEN^XCOJSMYWSNKFJD 

We note quickly that three Z's fall in the last three columns, stronq 
confirmation that the four numbers of the keying sequence selected are 
correct. 

Plaintext words are searched for between successive Z's. It is not 
too difficult. Here and there words appear; and finally the entire 
plaintext becomes evident: 

TO GENERAL SMITH SIX WOUNDED FOUR KILLED TWO MISSING 

With the plaintext now known, the keying sequence can be recovered: 

Ciphertext: QPGDVWVIJOKHTBKSGLX 
Plaintext: TOZGENERALZSMITHZSI 
Key: 10 4 6 10 0 10 0 0 10 0 10 0 6 10 4 0 6 4 6 

MANVFWWZCAELPOATBOU 

XZWOUNDEDZFOURZKILL 
10 0 10 10 0 10 0 4 6 0 10 0 10 6 0 4 10 0 6 

F W K M H V A RXLNRWZEAG. 

EDZTWOZMISSINGZZZ 
10 0 10 64 10 046460 10 6406 

With the keying sequence now recovered, the final step is to determine 
the "pin settings" of the two HAGELIN CRYPTOGRAPH wheels which generated 
the keying sequence; and at the same time to determine the lengths of the 
two wheels involved. 

With the four numbers of the keying sequence being 0, 4, 6, and 10. we 
know: 

(1) that when a 0 results, the positions of both wheels are in a 
non-effective position. 

(2) that when a 4 results, the position of the wheel containing four 
"lugs" is effective, and the other wheel (with its six "lugs") is non- 
effective . 
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(3) that when a 6 results, the position of the wheel containing 
six "lugs" is effective, and the other wheel (with four "lugs") is 
non-effective. 

(4) that when a 10 results, the positions, or "pins", of both wheels 
are effective. 

Therefore, "pin-settings" on the two wheels are determined to be the 
following: 

Key: 10 4 6 10 0 10 0 0 10 0 10 0 6 10 4 0 6 4 6 10 

Wheel #1: 60660600606066006066 

Wheel #2: 44040400404004400404 

0 10 10 0 10 0 4 6 0 10 0 10 6 0 4 10 0 6 10 0 

06606006060660060660 

04404040040400440040 

10 64 10 046460 10 6406 

660600606066006 

404404040040400 

Examination of the "pin settings" determined for the two wheels reveals 
that Wheel #1 is repeating every 19 letters and Wheel #2 is repeating every 
21 letters. Thus, the two wheels and their individual keying sequences 
are as follows: 

Wheel #1: 6066060060606600606 

Wheel #2: 440404004040044004040 

Before departing from this Chapter's analysis of the two-wheel HAGELIN 
CRYPTOGRAPH system, it might now be an appropriate time to introduce to the 
student one additional element or "complication" which the HAGELIN CRYPTOGRAPH'S 
inventor has added to the basic system already discussed. This additional 
element or "complication" is known as the overlap , an element which adds an 
additional degree of security to the basic HAGELIN CRYPTOGRAPH system. 

Let us, therefore, take a look at the function of the overlap . Essentially, 
where an overlap of "lug settings" exists between two wheels, when both wheels 
are effective (due to their respective "pin settings"), the effective sum of 
the "lugs" from each wheel is reduced by the amount of the overlap. 

Translated, this means that in the above cryptogram, for example, where Wheel 
#1 had six "lugs" and Wheel #2 had four "lugs", if there were an overlap of 
one "lug" between the two wheels, with both wheels effective the sum of the 
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"lugs" between tbe two wheels would not be 10/ but rather 9. If the 
overlap were two "lugs"/ the effective sum of tlxe two wheels would be 8, 
etc. 

In other words/ an overlap serves to reduce the otherwise arithmetical 
summation of "lugs" from two wheels by the amount of overlap. 

In the HAGELIN CRYPTOGRAPH/ therefore/ overlaps between wheels are a 
good possibility; and in the two-wheel HAGELIN CRYPTOGRAPH system/ the 
resultant key would then he 0, x, y_/ and where either ^ Z. 

or ^ is less than x + y• 

In the problems that follow/ in this and succeeding chapters/ except 
when otherwise indicated/ use of overlaps in cryptograms should generally 
be expected. 

PROBLEMS 


21. 

Message 

begins 

: 

"REPORT 

FROM**. 














M 

F 

K 

L 

M 

Q 

K 

I 

I 

z 

N 

A 

V 

J 

H 

L 

W 

A 

0 

Y 

N 

K 

G 

Z 

Y 


F 

V 

M 

0 

R 

Q 

G 

B 

L 

D 

Q 

V 

R 

E 

J 

M 

Z 

R 

L 

K 

B 

L 

K 

R 

Q 


Q 

J 

W 

W 

F 

Q 

D 

A 

Q 

P 

E 

D 

F 

U 

C 

W 

S 

D 

D 

K. 






22. 

Probable word: 

"BATTALION' 

1 















V 

H 

V 

W 

A 

M 

I 

N 

R 

Y 

T 

G 

N 

R 

A 

0 

H 

Z 

E 

S 

M 

M 

E 

R 

0 


W 

M 

Y 

L 

G 

M 

G 

U 

R 

R 

T 

G 

K 

B 

H 

I 

L 

C 

X 

L 

M 

D 

H 

A 

J 


Y 

U 

0 

G 

E 

R 

T 

M 

D 

M 

M 

V 

G 

R 

R 

I 

M 

V 

A 

B 

R 

I 

M 

0 

G 


B 

0 

S 

T 

M 

S 

V 

I 

H 

G. 
















23. 

Message 

begins: 

"TO 

CHIEF* 

1 















G 

T 

E 

F 

Y 

R 

Z 

U 

G 

L 

N 

Q 

0 

0 

F 

A 

P 

V 

F 

K 

X 

P 

S 

G 

H 


Z 

E 

N 

G 

Z 

U 

0 

E 

Q 

V 

D 

w 

I 

N 

T 

I 

D 

I 

Z 

R 

N 

L 

Q 

Z 

0 


R 

L 

Q 

A 

G. 





















24. 

Message 

begins: 

"CHANGE 

It 
















I 

X 

G 

M 

A 

A 

L 

W 

A 

I 

M 

H 

Q 

U 

L 

C 

P 

G 

R 

L 

S 

Y 

P 

K 

K 


D 

w 

I 

A 

0 

B 

S 

R 

V 

Y. 
















25. 

V 

p 

L 

X 

W 

R 

C 

K 

Q 

H 

V 

X 

X 

A 

A 

Y 

F 

V 

I 

Z 

T 

E 

F 

G 

I 


W 

K 

P 

G 

K 

H 

E 

P 

u 

A 

I 

M 

V 

E 

V 

M 

A 

X 

K 

V 

L 

A 

0 

S 

E 


V 

S 

0 

Q 

X 

V 

H 

P 

E 

L. 
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26. Lug-settings and pin-settings of the two-wheel HAGELIN CRYPTCX;raPH 
used to encipher the following messages are the same. Only the 
"starting points" or wheel-settings are different. Further, the 
text of both messages is the same. 


No. 1 

No. 2 


R A 0 L I 
A B Y Z A 
I E K Q M 
W W C V F 


P F F T L 

L A O P Q 


R E E M N 

Q A D N R 


A E I S F 

R N D T E 


D L A H I 

E G J D M 


27. Message begins: "TO". 


G 

N 

H 

B 

V 

Q 

H 

H 

T 

A 

G 

0 

C 

W 

0 

X 

H 

G 

N 

H 

Q 

Z 

G 

P 

C 

S 

W 

H 

Z 

A 

I 

G 

R 

Z 

B 

I 

A 

V 

L 

J 

Z 

T 

P 

C 

H 

M 

M 

K 

U 

K 

N 

A 

M 

R 

X 

V 

C 

F 

X 

A 

I 

E 

G 

T 

0 

I 

A 

0 

C 

C 

G 

U 

N 

U 

I 


R L M H A. 


28. Lug-settings and pin-settings used to encipher the following two 

messages are the same, but the messages have different wheel^settings 
or "starting points" on the generated keying sequence. 


No. 1- XYEKA DZUND 
No.2- SAYPA IPDWQ 


29. 


I Z J R R 
Y I D C G 
H H X H N 


H T V U H 
A I Y V Z 
I I G V V 


M T I A H 
N R Z D R 
G N X T T 


A W Q N D 
L Z F G Q 

P R U A G 
E F G C N 
G N R H J 


Z W Z J A 
L U D F I. 

M H W G U 
H B M I N 
V U G G H. 


R B I A D. 


30. N V A X K 
F X A I A 
I I L V W 
A Z S N L 


M V X Q A 
V B I I N 
G J W L F 
0 I I C I. 


D O D N L 
C U X M R 
S I U T H 


AILKF NXNXM 
ZGDCF RQSRO 
IJKHT TUXEC 
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Chapter 4 


ANALYSIS OF A THREE-WHEEL HAGELIN CRYPTOGRAPH 

In this chapter we continue our methodology of the HAGELIN CRYPTOGRAPH 
by analyzing the three-wheel HAGELIN CRYPTOGRAPH system. The student who 
by this time has a good understanding of the material presented in the 
first three chapters^ and who hopefully has solved most of the problems 
presentedr should have a good foundation for the progressively more 
difficult material of the present chapter. 

Eventually we shall analyze the HAGELIN CRYPTOGRAPH with six wheels. 
Meanwhile, the analysis of a three-wheel machine begins to approximate 
the final problem. 

Consider the following three-wheel problem where let us say the wheel 
lengths are known to be 17, 19, and 21. Let us say, too, that we know 
that the cryptogram begins with a stereotype beginning, the word "MESSAGE*' 
followed by a number. 

UBIMG ZVMHZ HOAHM LATHZ TVBIH 

HARQA IMRSZ PMSCF LHHBZ NNBQB 

GTSQV TBHGH. 

The first step, obviously, is to recover that portion of the keying 
sequence where the word "MESSAGE** is set against the message beginning: 

plaintext: messagez 

ciphertext: UBIMGZVM 

key: 7 61 57 60 12 

We might also examine the last group of the message, hoping that the 
letter Z has been used as a null to complete the group: 

plaintext: - z z z z 

ciphertext: TBHGH 

key: - 1 7 6 7 

The numbers recovered so far look extremely good. Indeed, it appears 
that they all could have been generated from the numbers 0, 1, 5, and 7. 
That is, the numbers could have been generated from the numbers 0 1 on 
one wheel, 0 5 on another wheel, and 0 7 on the third wheel. Thus, the 
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three wheels, 01,05, and 0 7, are capable of interacting (combining) 
in eight possible ways to generate eight possible different numbers: 


Wheel #1 
Wheel #2 
Wheel #3 
Generated key 


00001111 
05050505 
0077007 7 

0 5 7 12 1 6 8 13 


Note, however, that the above different possible generated keys are 
those obtained without overlaps between wheels. If an overlap of one 
"lug" exists between Wheel #2 and Wheel #3, the effect of 5 + 7 would 
be 11, rather than 12; and thus, 0+5+7 would = 11, and 1+5+7 
would = 12. Similarly, an overlap of two "lugs" between Wheel #2 and 
Wheel #3 would make 5 + 7 = 10; and thus, 0+5+7 would then = 10, 
and 1+5+7 would = 11. 


It appears, therefore, that from the information available to this 
point the different possible generated numbers of the keying sequence, 
with or without overlaps , must be eight of the following nine: 

0 1 5 6 7 8 11 12 13 


With this knowledge, let us look for the second word of the cryptogram’s 
text which we know from the message’s stereotype beginning to be a 
number: 


Ciphertext: 


messagez 

UBIMGZVMH 



(0 - 

s 


(1 - 

t 

Plaintext 

(5 - 

X 

from 

(6 - 

y 

possible 

(7 - 

z 

keys 

(8 - 

a 


(11- 

d 


(12- 

e 


(13- 

f 


Z 

H 

0 

A 

H 

M 

L 

A 

T 

a 

s 

1 

z 

s 

n 

o 

z 

g 

b 

t 

m 

a 

t 

o 

P 

a 

h 

f 

X 

q 

e 

X 

s 

t 

e 

1 

g 

y 

r 

f 

y 

t 

u 

f 

m 

h 

z 

s 

g 

z 

u 

V 

g 

n 

i 

a 

t 

h 

a 

V 

w 

h 

o 

1 

d 

w 

k 

d 

y 

z 

k 

r 

m 

e 

X 

1 

e 

z 

a 

1 

s 

n 

f 

y 

m 

f 

a 

b 

m 

t 


The problem essentially is 


to find which one of the 


following numbers 


fits the above possibilities: 


o n e z t e 

t w o z el 

threez tw 

f o u r z t h 

f i V e z f o 

s i X z f i 

sevenz si 

eightz se 

n i n e z e i 


n 

z 






n 

i 

n 

e 

t 

e 

V 

e 

n 

z 



t 

w 

e 

n 

t 

e 

1 

V 

e 

z 



t 

h 

i 

r 

t 

i 

r 

t 

e 

e 

n 

z 

f 

o 

r 

t 

y 

u 

r 

t 

e 

e 

n 

z 

f 

i 

f 

t 

y 

f 

t 

e 

e 

n 

z 


s 

i 

X 

t 

y 

X 

t 

e 

e 

n 

z 


s 

e 

V 

e 

n 

V 

e 

n 

t 

e 

e 

n z 

e 

i 

g 

h 

t 

g 

h 

t 

e 

e 

n 

z 

n 

i 

n 

t 

y 


e e n z 

y z 
y z 

z 

z 

z 

t y z 
y z 
z 
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One by one the various numbers are tested. For example, the first 
number is "o n e z". Since the first ciphertext letter, H, cannot 
give rise to a plaintext letter ” 0 ” with any of the possible keys, the 
number "o n e z" is an impossibility and may be discarded. After 
testing each of the possible numbers, it is found that only two are 
possible: 

( 1 ) ( 2 ) 

Plain: fifteenz Plain: sixteenz 

Cipher: HZHOAHML Cipher: HZHOAHML 

Key: 13 8 13 8 5 12 0 11 Key: 0 8 5 8 5 12 0 11 

We have already identified six numbers of the keying sequence, 0, 1, 

5, 6, 7, and 12, by setting the word "MESSAGE" against the message 
beginning. As a keying sequence generated from three wheels will 
consist of a maximum of eight different numbers, two numbers remain to 
be identified. But possibility (1) above adds three additional numbers, 

8, 11, and 13, to the already identified six. Possibility CL), 
therefore, is an impossibility; and the plaintext number "s i x t e e n z" 
is left as the only possible number to follow the word "MESSAGE" in 
the cryptogram. 

With the additional two numbers, 8 and 11, picked up from the word 
"sixteenz", the eight niombers comprising the keying sequence are: 

0 1 5 6 7 8 11 12 

Having already decided that the numbers of the generated key have 
probably come from the numbers 0 1 on one wheel, 0 5 on another wheel, 
and 0 7 on the third wheel, with the eight numbers making up the keying 
sequence being 0 1 5 6 7 8 11 12, what can we say about overlaps? 

It appears that there is an overlap of one "lug" between the wheel 
with five "lugs" and the wheel with seven "lugs"; thus, 5 + 7 = 11 and 
1 + 5 + 7 = 12, fitting perfectly the actual generated key. 

We can indicate the lug-setting with its overlap in the following 
fashion: 

r‘^~i 

15 7 
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Up to this point with respect to the solution of the given three-wheel 
cryptogram, we know: 

Cl) The lengths of the three wheels, 17, 19, and 21. 

(2) The lug-settings are 1, 5, and 7, with an overlap of one "lug” 
between the wheels with five and seven "lugs". 

C3) The keying sequence for the first 16 letters and last three 
letters of the message. 


In order to complete solution we must still: 

(1) Determine to which wheels the known lug-settings apply. 

(2) Determine the pin-settings of the three wheels. 

(3) Read the text of the cryptogram. 


To continue, let us "lay out" the message in the following manner: 


Plaintext: messagezsixteenz 
Ciphertext: UBIMGZVMHZHOAHMLAT 

Recovered key: 7615760 12 08585 12 0 11 

Wheel Length 17 
Wheel Length 19 
Wheel Length 21 

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 




19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 


z z z 

HHBZNNBQBGTSQVTBHGH 

7 6 7 


42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 



Note that the lengths of the wheels, above, are repetitively indicated. 
It can be seen, for example, that cryptogram letters in positions 1, 18, 
35, and 52 have been enciphered with key generated with the same pin of 
Wheel Length 17. 

Looking especially at that part of the cryptogram’s text where we have 
recovered key, it is noted that letters in positions 1-3 and 58-60 of the 
cryptogram have been enciphered with the same pins of Wheel Length 19. 
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Position 3, vrith its key of 1/ and position 60, with its key of 7, 
provide the evidence that Wheel Length 19 must contain five **lugs". 

The reasoning is as follows: 

(1) Position 3 and position 60 of Wheel Length 19 are enciphered 
with the same pin of Wheel Length 19; that is, there is a multiple 

of 19 positions between positions 3 and 60. 

(2) The pin of Wheel Length 19 in positions 3 and 60 must be in 
a negative or non-effective position, since an effective or positive 
pin could not contribute to both a 1 and 7 generated key; that is, 
keys of 1 and 7 can only arise from two different single effective 
wheels, in one case a single wheel with one "lug" and in the other 
case a different single wheel with seven "lugs". 

(3) With the pin of Wheel Length 19 non-effective in position 3, 
then in position 3 either Wheel Length 17 or Wheel Length 21, but not 
both, must be effective with one "lug" in order to give rise to the 
key of 1 in that position. 

(4) And vice-versa, in position 60 either Wheel Length 17 or 
Wheel Length 21, but not both, must be effective with seven "lugs" to 
give rise to the key of 7 in that position. 

(5) Thus, with lug totals of one and seven divided between Wheel 
Lengths 17 and 21, Wheel Length 19 must contain five "lugs". 

We can follow the same general line of reasoning to determine the 
number of "lugs" on Wheel Lengths 17 and 21: 

(1) Positions 7 and 58 are enciphered with the same pin of Wheel 
Length 17. 

(2) The pin of Wheel Length 17 in positions 7 and 58 must be 
non-effective, since the total generated key in position 7 is 0. 

(3) Since the pin of Wheel Length 17 in position 58 must likewise 
be non-effective, as Wheel Length 19 is known to have five "lugs", the 
resultant key of 7 in position 58 can only have come from Wheel Length 
21 being effective in that position with seven "lugs". 

(4) With Wheel Length 19 having five "lugs", and with Wheel 
Length 21 having seven "lugs". Wheel Length 17 must contain one "lug". 

Thus, with the number of "lugs" on each wheel known, the 
"effectiveness" of the pins of recovered generated key can be determined 
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as follows: 


Plaintext 


m 

e 

s 

s 

a 

g 

e 

z 

s 

i 

X 

t 

e 

e 

n 

z 



Ciphertext 


U 

B 

I 

M 

G 

z 

V 

M 

H 

Z 

H 

0 

A 

H 

M 

L 

A 

T 

Recovered key 


7 

6 

1 

5 

7 

6 

0 

12 

0 

8 

5 

8 

5 

12 

0 

11 



Wheel Length 17 


0 

1 

1 

0 

' 0 

1 

0 

1 

0 

1 

0 

1 

0 

1 

0 

0 


r“ 

Wheel Length 19 


0 

5 

0 

5 

0 

5 

0 

5 

0 

0 

5 

0 

5 

5 

0 

5 



Wheel Length 21 


7 

0 

0 

0 

7 

0 

0 

7 

0 

7 

0 

7 

0 

7 

0 

7 





1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

H Z T V B 

I 

H 

H 

A 

R 

Q 

A 

I 

M 

R 

S 

Z 

P 

M 

S 

C 

F 

L 


19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 


HHBZNNBQBGTSQVTBH 

G 

H 

7 

6 

7 

j — 

1 

0 


5 

0 

i_z 

0 

7 


42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 


Note, for example, that in position 1 where the generated key is 7, 
such a key can only arise if the pin of Wheel Length 21, with seven 
"lugs" thereon, is effective and the pins of the remaining two wheels 
are non-effective. Similarly, other generated keys can only arise if 
a certain wheel or wheels are effective and other wheels non-effective, 
etc. Remember, too, the effect of the overlap of one "lug" between 
Wheel Lengths 19 and 21. If both wheels are effective, their joint 
effectiveness is 11, i.e., 5 + 7 = 11, not 12. Thus, where the pins of 
all three wheels are effective, the resulting generated key will be 
1 + 5 + 7 = 12. 

With the "effectiveness" of pins determined for those positions of 
the message where key has been recovered, the now determined pins may 
be "marked" or indicated throughout the message as follows: 
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Plaintext 
Ciphertext 
Recovered key 
Wheel Length 17 
Wheel Length 19 
Wheel Length 21 


m 

e 

s 

s 

a 

g 

e 

z 

s 

i 

X 

t 

e 

e 

n 

z 


U 

B 

I 

M 

G 

z 

V 

M 

H 

Z 

H 

0 

A 

H 

M 

L 

A T 

7 

6 

1 

5 

7 

6 

0 

12 

0 

8 

5 

8 

5 

12 

0 

11 


0 

1 

1 

0 

0 

1 

0 

1 

0 

1 

0 

1 

0 

1 

0 

0 

I 0 

0 

5 

0 

5 

0 

5 

0 

5 

0 

0 

5 

0 

5 

5 

0 

5 


1 

0 

0 

0 

7 

0 

0 

7 

0 

7 

0 

7 

0 

7 

0 

7 


1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 18 


H 

Z 

T 

V 

B 

I 

H 

H 

A 

R 

Q 

A 

I 

M 

R 

S 

Z 

P 

M 

S C 

F 

L 

1 

1 

0 

0 

1 

0 

1 

0 

1 

0 

1 

0 

1 

0 

0 

1 0 

1 

1 

0 0 

1 

0 


IT 

5 

0 

5 

0 

5 

0 

5 

0 

0 

5 

0 

5 

5 

0 

5 



1 0 

5 

0 



“1 

1 7 

0 

0 

0 

7 

0 

0 

7 

0 

7 

0 

7 

0 7 

0 

7 




19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

29 

30 

31 

32 

33 

34 35 

36 

37 

38 39 

40 

41 

H 

H 

B 

Z 

N 

N 

B 

Q 

B 

G 

T 

S 

Q 

V 

T 

z 

B H 

7 

z 

G 

6 

z 

H 

7 




1 

0 

1 

0 

1 

0 

1 

0 

0 

1 0 

1 

1 

0 

0 

1 0 

1 

0 




5 

0 

5 

0 

5 

0 

0 

5 

0 

5 

5 

0 

5 



1 0 

5 

0 





IT 

0 

0 

0 

7 

0 

0 

7 

0 

7 

0 

7 

0 

7 

0 7 






42 

43 

44 

45 

46 

47 

48 

49 

50 

51 

52 

53 

54 

55 

56 

57 58 

59 

60 





At this point, identified pins fill most of the "spaces" in the 
message displayed above; and from these identified pins many additional 
keys are capable of being recovered, for example, positions 22 thru 
33. For the analyst, solution at this point is all but complete — and 
it is left to the student to complete if he desires. 

In the problems that follow, the student will be able to test and 
improve his own skill in recovering key, identifying various lug- 
settings of wheels, identifying pin-settings, etc. 


PROBLEMS 


31. Wheel-Lengths: 17, 19, 21; Message begins: "FIRST"; Probable 
word: "ENEMY". 


C 

U 

Q 

M Q 

C 

X 

0 

R 

G 

X 

W 

Z 

A 

C 

S 

W 

H 

Y 

U 

F 

Y 

D H 

W 

U 

J 

V 

W I 

B 

N 

U 

J 

A 

I 

Y 

R 

Z 

A 

G 

G 

H 

S 

T 

H 

C 

Q X 

T 

I 

I 

Q 

B F 

0 

Y 

P 

Y 

Q 

J 

G 

R 

Z 

0 

T 

A 

S 

L 

M 

0 

F 

W X 

G 

L 

C 

N 

T W 

T 

L 

I 

G 

V 

K 

D 

Z 

L 

M 

T 

J 

L 

C 

Y 

U 

D 

C F 

H 
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Wheel- 

-Lengths: 

26, 

25, 

23; 

Probable 

message 

beginning: 

1 

"REQUEST". 

K A U 

KG H 

N L 

E T 

L 

C 

T Z 

I 

P K P 

J 

M 


T P U 

P 

N 




J Y W 

U V H 

W K 

N E 

V 

K 

P V 

B 

IPG 

L 

G 


H J Z 

Z 

E 




G F Z 

MO V 

S P 

H J 

I 

C 

U R Q 

R T C 

F 

H. 








Wheel- 

-Lengths: 

23, 

21, 

19; 

Probable 

word: 

"ENEMY". 






V 0 J 

I A R 

L S 

G K 

L 

A 

E Y 

Q 

E Q G 

H 

Z 


S N X 

E 

K 




J Y Z 

R G K 

L E 

A I 

Y 

B 

A E 

D 

M K Q 

R 

F 


GAR 

S 

G 




P F V 

T D F 

0 K 

H E 

A 

N 

U M 

C 

B H F 

D 

E. 








Wheel- 

-Lengths: 

21, 

19, 

17; 


Probable word: 

• 

•CONTINUE". 






J L 0 

B V 0 

A A 

P W 

F 

M 

E E 

W 

Y E E 

X 

Z 


TDK 

J 

I 




C A I 

L M Y 

G E 

M L 

J 

F 

L K 

M 

PUR 

M 

T 


V 0 E 

F 

H 




S D U 

MG K 

G P 

R N 

0 

L 

F M 

A 

U S Y 

M 

R. 








Wheel* 

-Lengths: 

23, 

21, 

19; 

Both 

messages contain same 

plaintext, 

but have been 

enciphered with different "wheel 

. settings' 

II 




No. 1 

- I T N 

Y Y 

T 

F Y 

F 

R 

W G 

P L D 


G 

Y 

C V L 


I 

J 

M 

A J 


P R Q 

L M 

F 

W L 

R 

K 

K R 

H L A 


C 

X 

H A I. 






No. 2 

-FLY 

Q c 

U 

A A 

H 

S 

V C 

X A R 


Z 

W 

A D F 


N 

E 

H 

K E 


RSI 

T 0 

V 

H D 

Z 

C 

S N 

lie 


D 

W 

A I H. 







36. Wheel-Lengths: 21, 19, 17; All messages have been enciphered 
with the same initial "wheel settings". 


37 . 


No. 

1 

- 

Z 

R 

U 

K 

N 


I 

F 

E 

N 

0 


J 

T 

Z 

L 

W 


F 

G 

Y 

0 

A 

D 

N 

Y 

G 

C 




Z 

I 

Q 

Q 

N 


R 

P 

Y 

E 

F 


U 

R 

Z 

Y 

U 


F 

S 

G 

I 

K. 






No. 

2 

- 

L 

L 

M 

A 

Z 


Z 

C 

Z 

H 

P 


P 

P 

S 

0 

L 


F 

A 

C 

M 

S 

Y 

N 

D 

T 

A 




C 

E 

K 

Z 

B 


Z 

V 

B 

D 

C 


G 

H 

Y 

T 

D 


L 

N 

N 

N 

W 

W 

Q 

W 

V 

R 

No. 

3 

- 

A 

M 

H 

Q 

I 


I 

Y 

M 

H 

P 


Q 

W 

W 

0 

K 


I 

C 

Y 

G 

D 

P 

Y 

D 

B 

Q 




P 

I 

S 

A 

B 


R 

J 

L 

L 

c 


C 

N 

Y 

Y 

J 


T 

A 

X 

D 

J 

M 

F 

F 

E 

W 




X 

V 

H 

F 

D. 
























No. 

4 

- 

X 

Z 

Q Y 

H 


Q 

C 

E 

E 

A 


F 

B 

I 

K 

V 


W 

P 

N 

A 

T 

U 

H 

D 

U 

w 




V 

D 

R 

F 

R 


Q 

U 

G 

V 

F 


F 

I 

U 

I 

W 


H 

A 

A 

I 

K. 






No. 

5 

- 

I 

V 

M 

P 

C 


D 

D 

F 

Z 

D 


Y 

P"-T 

A 

K. 












Wheel- 

-Lengths 

23, 

21, 

19; 

Message 

beginning: 

ti 

'ENEMY' 

1 






X M 

A 

S 

G 


C 

0 

C 

0 

X 


H 

C 

P 

R 

Z 


S 

J 

X 

E 

A 


X 

P 

A G 

E 





X R 

A 

G 

A 


M 

L 

L 

p 

c 


S 

Z 

L 

I 

Q 


T 

M 

A 

B 

L 


D 

G 

B B 

R 





P Z 

A 

H 

E 


M 

0 

C 

L 

I 


M 

A 

F 

F 

D. 
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38. 


39. 


40. 


Wheel-Lengths 

21, 

19, 

17; 

Message begins * 

'RADIO 

TRANSMISSIONS" 

• 


T Z G C T L 

Q N 

Z R 


R Q W R H 

C 0 

R 

H K 


C T 

W Q L 



H Q Q Y K G 

D U 

V N 


N 

A Z X F 

J W 

V 

K K 


A D 

Y S E 



A K L F F L 

A G 

X H 


K 

P G L F 

P N 

F 

E Z 


G D 

Z D D. 



Wheel-Lengths 

26, 

25, 

23; 

Message 

begins with 

word ' 

■MESSAGE" 



followed by a 

number. 



cT 

G M A H 









A B R N M J 

V L 

B Q 


Y 

B P 

C 

L C 


A I 

P N B 



B L V F V P 

C W 

B A 


Q 

0 Z F E 

E C 

N 

D V 


C C 

A K F 



T H N I G C 

I B 

Y G 


M 

M Q Z E 

H D 

S 

Q P 


U R 

A K Q 



Z L M I W 0 

L G 

N F, 












Wheel-Lengths 

26, 

24, 

17; 

Messages have 

been enciphered with 



different "wheel settings* 

1 









No. 1 - A V B 

B Q 

A 

T 

G 

A Z M 

A J 0 

J 

Q 

U 

T N 

K B G P 

L 

J 

No. 2 - P W J 

X M 

R 

K 

Z 

P K B 

RAG 

H 

L 

C 

G G 

L P G N 

G 

H 

K R M 

V 0 

R 

D 

L 

E N Y 

X L G 

F 

T 

P 

A L 

S J 0 X 

R 

S 

V G M 

F P 

L 

0 

0 

L L X 

J G F 

P, 
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Chapter 5 


ANALYSIS OF A FOUR-WHEEL HAGELIN CRYPTOGRAPH 


In this chapter we have reached another "stepping stone" in our study 
of the cryptanalysis of the HAGELIN CRYPTOGRAPH. Having studied the 
analysis of the HAGELIN CRYPTOGRAPH in some detail up to the three-wheel 
system^ we are ready now to turn to the next progressively more difficult 
system, that of the four-wheel HAGELIN CRYPTOGRAPH. 


Therefore, let us turn our attention now to the solution of a HAGELIN 
cryptogram, enciphered with four wheels of lengths 17, 19, 21, and 23. 
Further, in order to introduce the student to an important "general 
method" to solve the HAGELIN CRYPTOGRAPH, we shall use this method to 
solve the cryptogram given. This method is particularly important because 
it is based upon "frequency considerations" of plaintext, rather than upon 
knowledge of a stereotype message beginning/ probab'^e words, etc.; and 
of course, too, the student should keep in mind that though in this case 
we are dealing with a four-wheel HAGELIN system, the same "principles" 
generally hold true for the ultimate six-wheel HAGELIN CRYPTOGRAPH. 


The cryptogram: 

N G A P Y 
J O F C N 
L G O M J 
B I Q I E 
G U A B D 

0 C F I M 
L O W A R 
I M O N N 
F R O K A 
F B H Q P 

Y U D A J 
C M G Q L 
H J N S E 
I T Y I P 
0 P B G N 


Z A T P X 
J E V V O 
H D A U G 
N I X A T 

V I H B R 

L X S Q O 
P X B A T 
X Y P U R 
X D K Q A 
D P S F G 

F A R L Z 
D J C E O 
Q F Y X D 
H P N 0 F 

Y Z X A P 


H C I R F 
Q D M W E 

V I A X V 
C H H R D 
D M B N D 

P Q U X D 

Y B D T Z 
Z W G L R 
S D H X U 
S H Q H A 

P W L H N 
0 P Y Q R 
L E V K J 
C P N V I 
M X V F W 


S P B K M 
T Q P V Q 
N H K W H 
R L G V M 
R M F A W 

K W V W I 
J F A T R 
C S B R M 
T W B W J 
O I D N J 

I Q I H I 
U P R L V 
M Q 0 E B 
A K U J R 
G I C G N 


F J R M H 
T B Q I M 
0 B E S V 
X X J N M 
X V I Z V 

R R R A C 
X V D Z K 
L W I T J 
N Q A Y A 
F G Z D T 

O Q J N F 
V Q K Y D 
C O J G M 
H X U M M 
J I V X A 
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M E M Q W 
S J L P R 
M K U Y D 
F Y E Y V 
N K I U L 

U R D Q S 
L I P V X 
Q V Z B K 
U A O U E 
L B V D P 

J L R I T 
J Q U A G 
N 0 A M C 
R T R B J 
E C J C A 

H L M L D 


Y F B R H 
W A A 0 L 
H H J I D 
T M H P I 
W K J Y H 

P Z Y J E 
I T S K B 

Y L A J C 
Q O U A G 
M Y H T A 

W Y E M R 
L S V V L 
H P T N S 
U S H U F 
F E K T Z 

E G T M E 


D A V E J 
L L H P Y 
D Z T A Z 
W Y O J Q 
S N M N H 

U N W^L U 
V D C D N 
X R A B X 
J R T Q D 
Q H B Z V 

C A Q A I 
U 0 J M W 
E L L J E 
A Y B B A 
M A H E I 

Z L I B N 


E R V S Y 
L V Y I L 
T G K Q H 
U M D S X 
I C J N L 

G S M I D 
M Y B C P 

V X F V D 
S D E D A 

V N B M V 

R O J T M 
R L M W J 
0 L F K I 
S D V J B 
D D S H P 

V P D N D. 


V A L W X 
U K O B Z 
A R H L Q 
L S B W K 
M F D F J 

X Y D Y J 
U N X R Z 
M J U Y U 
M K N P V 
K B Y N M 

B P D I V 
D U U K I 
O B I G K 

V Y Q D Q 
C X B G V 


It is noted that the cryptogram is fairly lengthy, 770 letters in 
length; or, assuming six letters per word, the cryptogram is about 
128 words long. 


Let us begin our analysis by writing the cryptogram horizontally 
with a "period" of 17, to produce 17 columns. Each column will then 
represent those letters enciphered with the same pin-setting of 
Wheel Length 17. 


1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

N 

G 

A 

P 

Y 

Z 

A 

T 

P 

X 

H 

C 

I 

R 

F 

S 

P 

B 

K 

M 

F 

J 

R 

M 

H 

J 

0 

F 

C 

N 

J 

E 

V 

V 

0 

Q 

D 

M 

W 

E 

T 

Q 

P 

V 

Q 

T 

B 

Q 

I 

M 

L 

G 

0 

M 

J 

H 

D 

A 

U 

G 

V 

I 

A 

X 

V 

N 

H 

K 

W 

H 

0 

B 

E 

S 

V 

B 

I 

Q 

I 

E 

N 

I 

X 

A 

T 

C 

H 

H 

R 

D 

R 

L 

G 

V 

M 

X 

X 

J 

N 

M 

G 

U 

A 

B 

D 

V 

I 

H 

B 

R 

D 

M 

B 

N 

D 

R 

M 

F 

A 

W 

X 

V 

I 

Z 

V 

0 

C 

F 

I 

M 

L 

X 

S 

Q 

0 

P 

Q 

U 

X 

D 

K 

W 

V 

W 

I 

R 

R 

R 

A 

C 

L 

0 

W 

A 

R 

P 

X 

B 

A 

T 

Y 

B 

D 

T 

Z 

J 

F 

A 

T 

R 

X 

V 

D 

Z 

K 

I 

M 

0 

N 

N 

X 

Y 

P 

U 

R 

Z 

W 

G 

L 

R 

C 

S 

B 

R 

M 

L 

W 

I 

T 

J 

F 

R 

0 

K 

A 

X 

D 

K 

Q 

A 

S 

D 

H 

X 

u 

T 

W 

B 

W 

J 

N 


26 



Q 

A 

Y 

A 

F 

B 

H 

Q 

P 

D 

P 

S 

F 

G 

S 

H 

Q 

H 

A 

0 

I 

D 

N 

J 

F 

G 

Z 

D 

T 

Y 

U 

D 

A 

J 

F 

A 

R 

L 

Z 

P 

W 

L 

H 

N 

I 

Q 

I 

H 

I 

0 

Q 

J 

N 

F 

C 

M 

G 

Q 

L 

D 

J 

C 

E 

0 

0 

P 

Y 

Q 

R 

U 

P 

R 

L 

V 

V 

Q 

K 

Y 

D 

H 

J 

N 

S 

E 

Q 

F 

Y 

X 

D 

L 

E 

V 

K 

J 

M 

Q 

0 

E 

B 

C 

0 

J 

G 

M 

I 

T 

Y 

I 

P 

H 

P 

N 

0 

F 

C 

P 

N 

V 

I 

A 

K 

u 

J 

R 

H 

X 

U 

M 

M 

0 

P 

B 

G 

N 

Y 

z 

X 

A 

p 

M 

X 

V 

F 

W 

G 

I 

c 

G 

N 

J 

I 

V 

X 

A 

M 

E 

M 

Q 

W 

Y 

F 

B 

R 

H 

D 

A 

V 

E 

J 

E 

R 

V 

S 

Y 

V 

A 

L 

W 

X 

S 

J 

L 

P 

R 

W 

A 

A 

0 

L 

L 

L 

H 

P 

Y 

L 

V 

Y 

I 

L 

U 

K 

0 

B 

Z 

M 

K 

U 

Y 

D 

H 

H 

J 

I 

D 

D 

Z 

T 

A 

Z 

T 

G 

K 

Q 

H 

A 

R 

H 

L 

Q 

F 

Y 
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Each column represents letters similarly enciphered with a given 
pin-setting on Wheel Length 17 — the pin being either "effective" 
or "non-effective". Thus, the 17 columns in effect represent two 
classes of columns, those columns with "effective" pins on Wheel Length 
17 and those columns with "non-effective" pins on Wheel Length 17. 

The student will remember that — 

(1) encipherment with a single-wheel of the HAGELIN CRYPTOGRAPH 
results in encipherment with two Beaufort cipher alphabets; that is, a 
single wheel results in two numbers of "key", one of the numbers 
being 0. 

(2) encipherment with two-wheels of the HAGELIN CRYPTOGRAPH 
results in an encipherment with four Beaufort cipher alphabets; that is, 
two wheels result in four numbers of "key", one of the four being 0. 

(3) encipherment with three-wheels of the HAGELIN CRYPTOGRAPH 


27 



results in an encipherment with eight Beaufort cipher alphabets; that 
is, three wheels result in eight numbers of "key”, one of the numbers 
being 0. 

Therefore, consider the 17 columns, above, which as we noted are ^ 
divided into two classes, those columns with "effective" pins on Wheel 
Length 17 and those columns with "non-effective" pins on Wheel Length 17. 

We may make the following important observations — 

(1) Letters within columns where the pins of Wheel Length 17 are 
"non-effective" are enciphered as the result of the other three wheels 
generating eight Beaufort cipher alphabets. For these letters it is 
just as if Wheel Length 17 did not exist. 

(2) Letters within columns, on the other hand, where the pins of 
Wheel Length 17 are "effective" are enciphered as the result of the 
generation of eight other Beaufort cipher alphabets by the other three 
wheels plus the constant "effectiveness" of Wheel Length 17. 

Thus, encipherment with four wheels of the HAGELIN CRYPTOGRAPH results 
in encipherment with 16 Beaufort cipher alphabets, eight Beaufort cipher 
alphabets produced by a "non-effective" pin on Wheel Length 17 and eight 
other Beaufort cipher alphabets produced by an "effective" pin on Wheel 
Length 17. 

By matching frequency distributions of each of the 17 columns we shall 
attempt to divide the columns into their two classes. Success will depend 
upon whether we have a sufficient number of letters within a column to 
provide a differentation between polyalphabeticity with eight alphabets 
of one class and polyalphabeticity with a different eight alphabets of 
another class. 

Frequency distributions of the 17 columns are as follows: 
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#4: ABCDEFGHIJKLMNOPQRSTUVWXYZ 

212212 32163222 3 1 3 332 
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The "cross-product sum" or Chi test, described by Dr* Solomon 
Kullback in his classic treatise, " Statistical Methods in Cryptanalysis ", 
provides a method to match frequency distributions. It is assumed that 
the student is fully acquainted with the Chi test which is of 
fundamental importance in cryptanalysis. 

For purpose of illustration consider the "matching" of Frequency 
Distribution #1 with Frequency Distribution #2: 
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Frequency Distribution #1: 
Frequency Distribution #2: 
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chi test (#1 and #2) = 


_ Sum of cross-products _ 


Ni X 


102 

2116 


= 0.048 


Where: x = 46 x 46 = 2116 

Sum of cross-products = 30+2+1+8+4+2+10+6+4+2+6+4+3+6+4+6+4 = 102 

In likewise fashion, the chi test is made each pair of frequency 
distributions — and results are as follows: 


#1 

+ 

#2 = 0.048 

#1 

+ 

#3 = 

0.037 

#1 

+ 

il 

0.034 

#1 

+ 

#5 = 0.030 

#1 

+ 

#6 = 

0.048 

#1 

+ 

#7 = 

0.036 

#1 

+ 

#8 = 0.036 

#1 

+ 

#9 = 

0.042 

#1 

+ 

#10 

= 0.030 

#1 

+ 

#11 = 0.037 

#1 

+ 

#12 

= 0.026 

#1 

+ 

#13 

= 0.037 

#1 

+ 

#14 = 0.043 

#1 

+ 

#15 

= 0.039 

#1 

+ 

#16 

= 0.045 

#1 

+ 

#17 = 0.044 









#2 

+ 

#3 = 0.039 

#2 

+ 

#4 = 

0.040 

#2 

+ 

#5 = 

0.037 

#2 

+ 

#6 = 0.048 

#2 

+ 

#7 = 

0.043 

#2 

+ 

#8 = 

0.044 

#2 

+ 

#9 = 0.039 

#2 

+ 

#10 

= 0.034 

#2 

+ 

#11 

= 0.031 

#2 

+ 

#12 = 0.032 

#2 

+ 

#13 

= 0.033 

#2 

+ 

#14 

= 0.039 

#2 

+ 

#15 = 0.035 

#2 

+ 

#16 

= 0.039 

#2 

+ 

#17 

= 0.040 

#3 

+ 

#4 = 0.042 

#3 

+ 

#5 = 

= 0.048 

#3 

+ 

#6 = 

^ 0.036 

#3 

+ 

#7 = 0.038 

#3 

+ 

#8 = 

= 0.039 

#3 

+ 

#9 = 

= 0.046 

#3 

+ 

#10 = 0.058 

#3 

+ 

#11 

= 0.048 

#3 

+ 

#12 

= 0.043 

#3 

+ 

#13 = 0.040 

#3 

+ 

#14 

= 0.033 

#3 

+ 

#15 

= 0.038 

#3 

+ 

#16 = 0.036 

#3 

+ 

#17 

= 0.029 
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#4 + 

#5 = 0.042 

#4 

+ 

#6 = 

0.036 

#4 

+ 

#7 = 

0.043 

#4 + 

#8 = 0.041 

#4 

+ 

#9 = 

0.038 

#4 

+ 

#10 = 

0.044 

#4 + 

#11 = 0.039 

#4 

+ 

#12 = 

0.047 

#4 

+ 

#13 = 

0.042 

#4 + 

#14 = 0.039 

#4 

+ 

#15 = 

0.045 

#4 

+ 

#16 = 

0.041 

#4 + 

#17 = 0.036 









#5 + 

#6 = 0.034 

#5 

+ 

#7 = 

0.043 

#5 

+ 

#8 = 

0.048 

#5 + 

#9 = 0.043 

#5 

+ 

#10 = 

0.057 

#5 

+ 

#11 = 

0.043 

#5 + 

#12 = 0.041 

#5 

+ 

#13 = 

0.036 

#5 

+ 

#14 = 

0.040 

#5 + 

#15 = 0.038 

#5 

+ 

#16 = 

0.036 

#5 

+ 

#17 = 

0.031 

#6 + 

#7 = 0.040 

#6 

+ 

#8 = 

0.040 

#6 

+ 

#9 = 

0.041 

#6 + 

#10 = 0.033 

#6 

+ 

#11 = 

0.030 

#6 

+ 

#12 = 

0.033 

#6 + 

#13 = 0.034 

#6 

+ 

#14 = 

0.040 

#6 

+ 

#15 = 

0.036 

#6 + 

#16 = 0.041 

#6 

+ 

#17 = 

0.044 





#7 + 

#8 = 0.054 

#7 

+ 

#9 = 

0.040 

#7 

+ 

#10 = 

0.039 

#7 + 

#11 = 0.033 

#7 

+ 

#12 = 

0.038 

#7 

+ 

#13 = 

0.039 

#7 + 

#14 = 0.047 

#7 

+ 

#15 = 

0.031 

#7 


#16 = 

0.049 

#7 + 

#17 = 0.037 









#8 + 

#9 = 0.037 

#8 

+ 

#10 = 

0.039 

#8 

+ 

#11 = 

0.035 

#8 + 

#12 = 0.040 

#8 

+ 

#13 = 

0.034 

#8 

+ 

#14 = 

0.041 

#8 + 

#15 = 0.037 

#8 

+ 

#16 = 

0.043 

#8 

+ 

#17 = 

0.037 

#9 + 

#10 = 0.043 

#9 

+ 

#11 = 

0.049 

#9 

+ 

#12 = 

0.029 

#9 + 

#13 = 0.039 

#9 

+ 

#14 = 

0.044 

#9 

+ 

#15 = 

0.033 

#9 + 

#16 = 0.029 

#9 

+ 

#17 = 

0.041 





#10 ■ 

f #11 = 0.047 

#10 + #12 

= 0.048 

#10 ■ 

t- #13 

= 0.043 

#10 - 

#14 = 0.033 

#10 - 

f #15 

= 0.043 

#10 ■ 

t- #16 

= 0.037 

#10 ■ 

¥ #17 = 0.028 









#11 ■ 

f #12 = 0.033 

#11 ■ 

f #13 

= 0.039 

#11 ■ 

f #14 

= 0.033 

■'#11 ■ 

f #15 = 0.045 

#11 ■ 

^ #16 

= 0.039 

#11 ■ 

#17 

= 0.042 
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#12 + #13 = 0.037 
#12 + #16 = 0.033 


#12 + #14 = 0.033 
#12 + #17 = 0.027 


#12 + #15 = 0.044 


#13 + #14 = 0.043 #13 + #15 = 0.043 #13 + #16 = 0.040 

#13 + #17 = 0.044 


#14 + #15 = 0.034 

#14 + #16 = 0.046 

#14 + #17 = 0.044 

#15 + #16 = 0.032 

#15 + #17 = 0.040 



#16 + #17 = 0.039 


The above chi test results indicate the degree of 

likelihood that matched pairs of frequency distributions are from the 
same class of "eight-alphabet polyalphabeticity". The larger the value 
of the result, the more likely it is that the pairs of frequency 
distributions are of the same class; and conversely, the lower the 
value of the result, the less likely it is that the pairs are of the 
same class. 

A tabulation of the above results shows: 

(1) the three lowest results are 0.026/ 0.027/ and 0.028. 

(2) the three largest results are 0.054/ 0.057/ and 0.058. 

(3) the average or median result is 0.039. 

Based on these results/ we can say then that a result less than 
0.039 is more likely to be an incorrect match/ while a result larger 
than 0.039 is more likely to be a correct match. 

Let us make the assumption that the three lowest results are a valid 
indication of an incorrect match; and that the three largest results 
are a valid indication of a correct match. We have then: 

Correct match Incorrect match 


#7 + #8 = 0.054 
#5 + #10 = 0.057 
#3 + #10 = 0.058 
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#1 + #12 = 0.026 
#12 + #17 = 0.027 
#10 + #17 = 0.028 











From these matches we can see that: 

CD #7 and #8 are in the same class. 

C2) #1 and #17 are in the same class. 

C3) #3, #5, #10, and #12 are in the same class. 

C4) #1 and #17 are not in the same class as #3, #5, #10, and #17. 

Labelling #1 and #17 as Class A, and #3, #5, #10, and #12 as Class B, 
let us continue by comparing Frequency Distribution #2 with these 
tentative classes: 

Class A Class B 

#2 + #1 = 0.048 #2 + #3 = 0.039 

#2 + #17 = 0.040 #2 + #5 = 0.037 

#2 + #10 = 0.034 
#2 + #12 = 0.032 

From these matches or comparisons it appears Frequency Distribution 
#2 is clearly in Class A. Therefore, #2 may be added to #1 and #17 in 
Class A. 

In the same manner, let us compare Frequency Distribution #4 with 
Classes A and B: 

Class A Class B 

#4 + #1 = 0.034 #4 + #3 = 0.042 

#4 + #2 = 0.040 #4 + #5 = 0.042 

#4 + #17 =0.036 #4 + #10 = 0.044 

#4 + #12 = 0.047 

From these comparisons it appears that Frequency Distribution #4 
is almost surely in Class B; and, therefore, #4 is added to Class B. 

Again in the same manner. Frequency Distribution #6 can be compared 
with Classes A and B: 

Class A Class B 

#6 + #1 = 0.048 #6 + #3 = 0.036 

#6 + #2 = 0.048 #6 + #4 = 0.036 

#6 + #17 = 0.044 #6 + #5 = 0.034 

#6 + #10 = 0.033 

#6 + #12 = 0.033 

It could hardly be more clear that Frequency Distribution #6 is in 
Class A; and, with no hesitation #6 can be added to #1, #2, and #17 in 
Class A. 


33 










To continue. Frequency Distribution #14 is compared with the 
distributions of Classes A and B: 


Class A 

#14 + #1 = 0.043 
#14 + #2 = 0.039 
#14 + #6 = 0.040 
#14 + #17 = 0.044 


Class B 

#14 + #3 = 0.033 
#14 + #4 = 0.039 
#14 + #5 = 0.040 
#14 + #10 = 0.033 
#14 + #12 = 0.033 


It appears clear that Frequency Distribution #14 can be added to 
Class A. 


Continuing, Frequency Distribution #15 is matched with the 


distributions of Class A and B: 
Class A 

#15 + #1 « 0.039 
#15 + #2 = 0.035 
#15 + #6 = 0.036 
#15 + #14 = 0.034 
#15 + #17 = 0.040 


Class B 

#15 + #3 = 0.038 
#15 + #4 = 0.045 
#15 + #5 = 0.038 
#15 + #10 = 0.043 
#15 + #12 = 0.044 


It seems evident that Frequency Distribution #15 is in Class B; 
and #15, therefore, is added to the distributions of Class B. 

Frequency Distribution #16 is compared with the distributions of 


Classes A and B; 

Class A 

#16 + #1 = 0.045 
#16 + #2 = 0.039 
#16 + #6 = 0.041 
#16 + #14 = 0.046 
#16 + #17 = 0.039 

With the exception of (#16 + #4 


Class B 

#16 + #3 = 0.036 
#16 + #4 = 0.041 
#16 + #5 = 0.036 
#16 + #10 = 0.037 
#16 + #12 = 0.033 
#16 + #15 = 0.032 

0.041), Frequency Distribution #16 


fits well into Class A; and, therefore. Class A gains another 
distribution. 








Frequency Distribution #11 is compared with the distributions in 
the expanding Classes A and B: 

Class A Class B 


#11 + #1 = 0.037 
#11 + #2 = 0.031 
#11 + #6 = 0.030 
#11 + #14 = 0.033 
#11 + #16 = 0.039 
#11 + #17 = 0.042 


#11 + #3 = 0.048 
#11 + #4 = 0.039 
#11 + #5 = 0.043 
#11 + #J0 = 0.047 
#11 + #12 = 0.033 
#11 + #15 = 0.045 


Visually it can be seen that it is most probable that Frequency 
Distribution #11 belongs in Class B. But this comparison brings up a 
good point: the values derived from the chi test (or any other test) 
will not prove a "fact" beyond a shadow of doubt and should not be 
taken as positive proof. Thus, in the above comparisons, we should 
assume that (#11 + #17 = 0.042) and (#11 + #12 = 0.033) have simply 
occurred by chance; and to make a sound decision as to what Class to 
put Distribution #11 into depends upon how Distribution #11 compares 
to the distributions of Class A "as a whole" and to the distributions 
of Class B "as a whole". 

While we could add all the frequencies of the distributions in Class 
A together and make a new chi test with Distribution #11 on a larger 
scale, and do the same for Class B, and though this would be very 
accurate, for our purpose here it appears fairly evident, in spite of 
C#ll + #17 = 0.042) and (#11 + #12 = 0.033), that Frequency Distribution 
#11 belongs in Class B. Indeed, another way of looking at the decision 
making process is to take the "average" of the chi test results of 
Class A, above, and compare it with the "average" of the results of 
Class B. It will be found that the "average" of the chi test results 
of Class A, above, is 0.035; and the "average" of the Class B results 
is 0.042. Thus, it is most probable that Frequency Distribution #11 
belongs in Class B. 

Let us turn now to Frequency Distributions #7 and #8, which we 
assumed originally, to be in the same class. Let us attempt to place 
these two distributions either in Class A or Class B. 

We shall match, therefore, distributions #7 and #8 with the various 


35 










(JistriButions w&icR now conipirise Class A and Class B, as follows: 


Class A 

#7 + #1 = 0.036 
#7 + #2 = 0.043 
#7 + #6 = 0.040 
#7 + #14 = 0.047 
#7 + #16 = 0.049 
#7 + #17 = 0.037 


Class B 

#7 + #3 = 0.038 
#7 + #4 = 0.043 
#7 + #5 = 0.043 
#7 + #10 = 0.039 
#7 + #11 = 0.033 
#7 + #12 = 0.038 
#7 + #15 = 0.031 


#8 + #1 = 0.036 
#8 + #2 = 0.044 
#8 + #6 = 0.040 
#8 + #14 = 0.041 
#8 + #16 = 0.043 
#8 + #17 = 0.037 


#8 + #3 = 0.039 
#8 + #4 = 0.041 
#8 + #5 = 0.048 
#8 + #10 = 0.039 
#8 + #11 = 0.035 
#8 + #12 = 0.040 
#8 + #15 = 0.037 


It is likely that most analysts would subjectively select Class A 
for inclusion of Frequency Distributions #7 and #8; but taking the 
average of the chi test results of Class A vs. the average of the 
chi test results of Class B would provide a method of making purely 
an objective determination. Thus, the average of the Class A results 
is 0.041'*' and the average of the Class B results is 0.039 . It 
would appear that Frequency Distributions #7 and #8 do belong in 
Class A. 

We turn now to Frequency Distribution #9. Matching Distribution 
#9 against the distributions of Classes A and B produces the following 
Class A Class B 


#9 

+ 

#1 = 

0.042 

#9 

+ 

#3 = 

= 0.046 

#9 

+ 

#2 = 

0.039 

#9 

+ 

#4 = 

' 0.038 

#9 

+ 

#6 = 

0.041 

#9 


#5 = 

= 0.043 

#9 

+ 

#7 = 

0.040 

#9 

+ 

#10 

= 0.043 

#9 

-I- 

#8 = 

0.037 

#9 

+ 

#11 

= 0.049 

#9 

+ 

#14 ^ 

= 0.044 

#9 


#12 

= 0.029 

#9 

+ 

#16 

= 0.029 

#9 

+ 

#15 

= 0.033 

#9 

+ 

#17 

= 0.041 
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Here we indeed have a problemI But after all this is the typical 
HAGELIN CRYPTOGRAPH problem — on a reduced scale, perhaps, because this 
is a four-wheel cryptogram. But nonetheless the inability to "clearly” 
put a distribution into this or that class is common, especially where 
the amount of text is limited. In the present case we have about 45 
letters per column. With the 45 letters representing the polyalphabet- 
icity of eight different alphabets, it is no wonder that there will be 
expected difficulty to successfully match all the distributions. We 
have two choices. We can simply make an "educated guess" as to which 
class the distribution belongs, or we can attempt to continue with the 
solution without identifying the class to which the column belongs. 

In matching Frequency Distribution #9, the average chi test result 
of the Class A comparisons is 0.039"*”, and the average chi test result 
of the Class B comparisons is 0.040^. With any degree of reliability, 
and with the amount of text available, we cannot at this point put the 
distribution in either Class A or Class B. Therefore, for the moment 
let us leave Frequency Distribution #9 unidentified as to class. 


We are left with the final distribution. Frequency Distribution #13. 


Matching Frequency Distribution #13 with the distributions of the 


Classes A and B produces the following: 


Class A 

#13 + #1 = 0.037 
#13 + #2 = 0.033 
#13 + #6 = 0.034 
#13 + #7 = 0.039 
#13 + #8 = 0.034 
#13 + #14 = 0.043 
#13 + #16 = 0.040 
#13 + #17 = 0.044 


Class B 

#13 + #3 = 0.040 
#13 + #4 = 0.042 
#13 + #5 = 0.036 
#13 + #10 = 0.043 
#13 + #11 = 0.039 
#13 + #12 = 0.037 
#13 + #15 = 0.043 


Again, even visually we can quickly see that Frequency Distribution 
#13 does not clearly fit into either Class A or Class B. Just as we did 
with Distribution #9, for the moment let us leave Frequency Distribution 
#13 unidentified as to class. 


Thus, in summary before going on to the next step in the solution of 
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our given cryptogram, we have up to this point divided 15 of 17 pins 
on Wheel Length 17 into two arbitrary classes. Class A and Class B. 
One of the classes represents "effective" pins and one represents 
"non-effective" pins. The classes are: 

Class A: 1, 2, 6, 7, 8, 14, 16, and 17. 

Class B: 3, 4, 5, 10, 11, 12, and 15. 

Before turning to Wheel Length 19, let us once again write the 
cryptogram horizontally with a "period" of 17, producing 17 columns; 
but this time let us identify the individual letters in their columns 
with the small-letters "a" and "b" to indicate the class to which the 
letters belong. 


1 

2 

3 

4 

5 

6 

7 

8 

9 

10 11 12 13 

14 15 16 17 

Na 

Ga 

Ab 

Pb 

Yb 

Za 

Aa 

Ta 

P 

Xb 

Hb 

Cb 

I 

Ra 

Fbr~ 

Sa 

Pa 

ga 

Ka 

Mb 

Fb 

Jb 

Ra 

Ma 

Ha 

J 

Ob 

Fb 

Cb 

N 

Ja 

Eb 

Va 

Va 

Oa 

Qa 

Db 

Mb 

Wb 

Ea 

Ta 

Qa 

P 

Vb 

Qb 

Tb 

B 

Qa 

Ib 

Ma 

La 

Ga 

Oa 

Mb 

Jb 

Hb 

Da 

Aa 

Ua 

G 

Vb 

Ib 

Ab 

X 

Va 

Nb 

Ha 

Ka 

Wa 

Ha 

Ob 

Bb 

Eb 

Sa 

Va 

Ba 

I 

Qb 

Ib 

Eb 

N 

la 

Xb 

Aa 

Ta 

Ca 

Ha 

Hb 

Rb 

Db 

Ra 

La 

Ga 

V 

Mb 

Xb 

Xb 

J 

Na 

Mb 

Ga 

Ua 

Aa 

Ba 

Db 

Vb 

Ib 

Ha 

Ba 

Ra 

D 

Mb 

Bb 

Nb 

D 

Ra 

Mb 

Fa 

Aa 

Wa 

Xa 

Vb 

Ib 

Zb 

Va 

Oa 

Ca 

F 

Ib 

Mb 

Lb 

X 

Sa 

Qb 

Oa 

Pa 

Qa 

Ua 

Xb 

Db 

Kb 

Wa 

Va 

Wa 

I 

Rb 

Rb 

Rb 

A 

Ca 

Lb 

Oa 

Wa 

Aa 

Ra 

Pb 

Xb 

Bb 

Aa 

Ta 

Ya 

B 

Db 

Tb 

Zb 

J 

Fa 

Ab 

Ta 

Ra 

Xa 

Va 

Db 

Zb 

Kb 

la 

Ma 

Oa 

N 

Nb 

Xb 

Yb 

P 

Ua 

Rb 

Za 

Wa 

Ga 

La 

Rb 

Cb 

Sb 

Ba 

Ra 

Ma 

L 

Wb 

Ib 

Tb 

J 

Fa 

Rb 

Oa 

Ka 

Aa 

Xa 

Db 

Kb 

Qb 

Aa 

Sa 

Da 

H 

Xb 

Ub 

Tb 

W 

Ba 

Wb 

Ja 

Na 

Qa 

Aa 

Yb 

Ab 

Fb 

Ba 

Ha 

Qa 

P 

Db 

Pb 

Sb 

F 

Ga 

Sb 

Ha 

Qa 

Ha 

Aa 

Ob 

Ib 

Db 

Na 

Ja 

Fa 

G 

Zb 

Db 

Tb 

Y 

Ua 

Db 

Aa 

Ja 

Fa 

Aa 

Rb 

Lb 

Zb 

Pa 

Wa 

La 

H 

Nb 

Ib 

Qb 

I 

Ha 

Ib 

Oa 

Qa 

Ja 

Na 

Fb 

Cb 

Mb 

Ga 

Qa 

La 

D 

Jb 

Cb 

Eb 

0 

Oa 

Pb 

Ya 

Qa 

Ra 

Ua 

Pb 

Rb 

Lb 

Va 

Va 

Qa 

K 

Yb 

Db 

Hb 

J 

Na 

Sb 

Ea 

Qa 

Fa 

Ya 

Xb 

Db 

Lb 

Ea 

Va 

Ka 

J 

Mb 

Qb 

Ob 

E 

Ba 

Cb 

Oa 

J a 

Ga 

Ma 

Ib 

Tb 

Yb 

la 

Pa 

Ha 

P 

Nb 

Ob 

Fb 

C 

Pa 

Nb 

Va 

la 

Aa 

Ka 

Ub 

Jb 

Rb 

Ha 

Xa 

Ua 

M 

Mb 

Ob 

Pb 

B 

Ga 

Nb 

Ya 

Za 

Xa 

Aa 

Pb 

Mb 

X3D 

Wa 

Ea 

Wa 

G 

Ib 

Cb 

Gb 

N 

Ja 

Ib 

Va 

Xa 

Aa 

Ma 

Eb 

Mb 

Qb 

Wa 

Ya 

Fa 

B 

Rb 

Hb 

Db 

A 

Va 

Eb 

Ja 

Ea 

Ra 

Va 

Sb 

Yb 

Vb 

Aa 

La 

Wa 

X 

Sb 

Jb 

Lb 

P 

Ra 

Wb 

Aa 

Aa 

Oa 

La 

Lb 

Lb 

Hb 

Pa 

Ya 

La 

V 

Yb 

Ib 

Lb 

U 

Ka 

Ob 

Ba 

Za 

Ma 

Ka 

Ub 

Yb 

Db 

Ha 

Ha 

Ja 

I 

Db 

Db 

Zb 

T 

Aa 

Zb 

Ta 

Ga 

Ka 

Qa 

Hb 

Ab 

Rb 

Ha 

La 

Qa 

F 

Yb 

Eb 

Yb 

V 

Ta 

Mb 

Ha 

Pa 

la 

Wa 

Yb 

Ob 

Jb 

Qa 

Ua 

Ma 

D 

Sb 

Xb 

Lb 

S 

Ba 

Wb 

Ka 

Na 

Ka 

la 

Ub 

Lb 

Wb 

Ka 

Ja 

Ya 

H 

Sb 

Nb 

Mb 

N 

Ha 

Ib 

Ca 

Ja 

Na 

La 

Mb 

Fb 

Db 

Fa 

Ja 

Ua 

R 

Db 

Qb 

Sb 

P 

Za 

Yb 

Ja 

Ea 

Ua 

Na 

Wb 

Lb 

Ub 

Ga 

Sa 

Ma 

I 

Db 

Xb 

Yb 

D 

Ya 

Jb 

La 

la 

Pa 

Va 

Xb 

Ib 

Tb 

Sa 

Ka 

Ba 

V 

Db 

Cb 

Db 

N 

Ma 

Yb 

Ba 

Ca 

Pa 

Ua 

Nb 

Xb 

Rb 

Za 

Qa 

Va 

z 

Bb 

'Kb 

Yb 

L 

Aa 

Jb 

Ca 

Xa 

Ra 

Aa 

Bb 

Xb 

Vb 

Xa 

Fa 

Va 

D 

Mb 

Jb 

Ub 

Y 

Ua 

Ub 

Aa 

Oa 

Ua 

Ea 

Qb 

Ob 

Ub 

Aa 

Ga 

Ja 

R 

Tb 

Qb 

Db 

S 

Da 

Eb 

Da 

Aa 

Ma 

Ka 

Nb 

Pb 

Vb 

La 

Ba 

Va 

D 

Pb 

Mb 

Yb 

H 

Ta 

Ab 

Qa 

Ha 
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Ba 

Za 

Vb 

Yb 

Nb 

Ba 

Ma 

Va. 

K 

Bb 

Yb 

Nb 

M 

Ja 

Lb 

Ra 

la 

Ta 

Wa 

Yb 

Eb 

Mb 

Ra 

Ca 

Aa 

Q 

Ab 

Ib 

Rb 

0 

Ja 

Tb 

Ma 

Ba 

Pa 

Da 

Ib 

Vb 

Jb 

Qa 

Ua 

Aa 

G 

Lb 

Sb 

Vb 

V 

La 

Ub 

Oa 

Ja 

Ma 

Wa 

Rb 

Lb 

Mb 

Wa 

Ja 

Da 

U 

Ub 

Kb 

Ib 

N 

Oa 

Ab 

Ma 

Ca 

Ha 

Pa 

Tb 

Nb 

Sb 

Ea 

La 

La 

J 

Eb 

Ob 

Lb 

F 

Ka 

Ib 

Oa 

Ba 

la 

Ga 

Kb 

Rb 

Tb 

Ra 

Ba 

Ja 

U 

Sb 

Hb 

Ub 

F 

Aa 

Yb 

Ba 

Ba 

Aa 

Sa 

Db 

Vb 

Jb 

Ba 

Va 

Ya 

Q 

Db 

Qb 

Eb 

C 

Ja 

Cb 

Aa 

Fa 

Ea 

Ka 

Tb 

Zb 

Mb 

Aa 

Ha 

Ea 

I 

Db 

Db 

Sb 

H 

Pa 

Cb 

Xa 

Ba 

Ga 

Va 

Hb 

Lb 

Mb 

La 

Da 

Ea 

G 

Tb 

Mb 

EB 

Z 

La 

Ib 

Ba 

Na 

Va 

Pa 

Db 

Nb 

Db, 














Now we may turn to Wheel Length 19 — to the next phase of our 
solution. Again, let us write the cryptogram horizontally, this time 
with a "period" of 19, to produce 19 columns; but, in writing the 
cryptogram we shall keep the class-identifying letter, "a" or "b", 
with the basic cryptogram letter as shown above. 


1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

Na 

Ga 

Ab 

Pb 

Yb 

Za 

Aa 

Ta 

P 

Xb 

Hb 

Cb 

I 

Ra 

Fb 

Sa 

Pa 

Ba 

Ka 

Mb 

Fb 

Jb 

Ra 

Ma 

Ha 

J 

Ob 

Fb 

Cb 

N 

Ja 

Eb 

Va 

Va 

Oa 

Qa 

Db 

Mb 

Wb 

Ea 

Ta 

Qa 

P 

Vb 

Qb 

Tb 

B 

Qa 

Ib 

Ma 

La 

Ga 

Oa 

Mb 

Jb 

Hb 

Da 

Aa 

Ua 

G 

Vb 

Ib 

Ab 

X 

Va 

Nb 

Ha 

Ka 

Wa 

Ha 

Ob 

Bb 

Eb 

Sa 

Va 

Ba 

I 

Qb 

Ib 

Eb 

N 

la 

Xb 

Aa 

Ta 

Ca 

Ha 

Hb 

Rb 

Db 

Ra 

La 

Ga 

V 

Mb 

Xb 

Xb 

J 

Na 

Mb 

Ga 

Ua 

Aa 

Ba 

Db 

Vb 

Ib 

Ha 

Ba 

Ra 

D 

Mb 

Bb 

Nb 

D 

Ra 

Mb 

Fa 

Aa 

Wa 

Xa 

Vb 

Ib 

Zb 

Va 

Oa 

Ca 

F 

Ib 

Mb 

Lb 

X 

Sa 

Qb 

Oa 

Pa 

Qa 

Ua 

Xb 

Db 

Kb 

Wa 

Va 

Wa 

I 

Rb 

Rb 

Rb 

A 

Ca 

Lb 

Oa 

Wa 

Aa 

Ra 

Pb 

Xb 

Bb 

Aa 

Ta 

Ya 

B 

Db 

Tb 

Zb 

J 

Fa 

Ab 

Ta 

Ra 

Xa 

ya 

Db 

Zb 

Kb 

la 

Ma 

Oa 

N 

Nb 

Xb 

Yb 

P 

Ua 

Rb 

Za 

Wa 

Ga 

La 

Rb 

Cb 

Sb 

Ba 

Ra 

Ma 

L 

Wb 

Ib 

Tb 

J 

Fa 

Rb 

Oa 

Ka 

Aa 

Xa 

Db 

Kb 

Qb 

Aa 

Sa 

Da 

H 

Xb 

Ub 

Tb 

W 

Ba 

Wb 

Ja 

Na 

Qa 

Aa 

Yb 

Ab 

Fb 

Ba 

Ha 

Qa 

P 

Db 

Pb 

Sb 

F 

Ga 

Sb 

Ha 

Qa 

Ha 

Aa 

Ob 

Ib 

Db 

Na 

J a 

Fa 

G 

Zb 

Db 

Tb 

Y 

Ua 

Db 

Aa 

J a 

Fa 

Aa 

Rb 

Lb 

Zb 

Pa 

Wa 

La 

H 

Nb 

Ib 

Qb 

I 

Ha 

Ib 

Oa 

Qa 

Ja 

Na 

Fb 

Cb 

Mb 

Ga 

Qa 

La 

D 

Jb 

Cb 

Eb 

0 

Oa 

Pb 

Ya 

Qa 

Ra 

Ua 

Pb 

Rb 

Lb 

Va 

Va 

Qa 

K 

Yb 

Db 

Hb 

J 

Na 

Sb 

Ea 

Qa 

Fa 

Ya 

Xb 

Db 

Lb 

Ea 

Va 

Ka 

J 

Mb 

Qb 

Ob 

E 

Ba 

Cb 

Oa 

Ja 

Ga 

Ma 

Ib 

Tb 

Yb 

la 

Pa 

Ha 

P 

Nb 

Ob 

Fb 

C 

Pa 

Nb 

Va 

la 

Aa 

Ka 

Ub 

Jb 

Rb 

Ha 

Xa 

Ua 

M 

Mb 

Ob 

Pb 

B 

Ga 

Nb 

Ya 

Za 

Xa 

Aa 

Pb 

Mb 

Xb 

Va 

Fa 

Wa 

G 

Ib 

Cb 

Gb 

N 

Ja 

Ib 

Va 

Xa 

Aa 

Ma 

Eb 

Mb 

Qb 

Wa 

ya 

Ta 

B 

Rb 

Hb 

Db 

A 

Va 

Eb 

Ja 

Ea 

Ra 

Va 

Sb 

Yb 

Vb 

Aa 

La 

Wa 

X 

Sb 

Jb 

Lb 

P 

Ra 

Wb 

Aa 

Aa 

Oa 

La 

Lb 

Lb 

Hb 

Pa 

Ya 

La 

V 

Yb 

Ib 

Lb 

U 

Ka 

Ob 

Ba 

Za 

Ma 

Ka 

Ub 

Yb 

Db 

Ha 

Ha 

Ja 

I 

Db 

Db 

Zb 

T 

Aa 

Zb 

Ta 

Ga 

Ka 

Qa 

Hb 

Ab 

Rb 

Ha 

La 

Qa 

F 

Yb 

Eb 

Yb 

V 

Ta 

Mb 

Ha 

Pa 

la 

WaVYbC 

:Ob 

Jb 

Qa 

Ua 

Ma 

D 

Sb 

Xb 

Lb 

S 

Ba 

Wb 

Ka 

Na 

Ka 

la 

Ub 

Lb 

Wb 

Ka 

Ja 

Ya 

H 

Sb 

Nb 

Mb 

N 

Ha 

Ib 

Ca 

Ja 

Na 

La 

Mb 

Fb 

Db 

Fa 

Ja 

Ua 

R 

Db 

Qb 

Sb 

P 

Za 

Yb 

Ja 

Ea 

Ua 

Na 

Wb 

Lb 

Ub 

Ga 

Sa 

Ma 

I 

Db 

Xb 

Yb 

D 

Ya 

Jb 

La 

la 

Pa 

Va 

Xb 

Ib 

Tb 

Sa 

Ka 

Ba 

V 

Db 

Cb 

Db 

N 

Ma 

Yb 

Ba 

Ca 

Pa 

Ua 

Nb 

Xb 

Rb 

Za 

Qa 

Va 

Z 

Bb 

Kb 

Yb 

L 

Aa 

Jb 

Ca 

Xa 

Ra 

Aa 

Bb 

Xb 

Vb 

Xa 

Fa 

Va 

D 

Mb 

Jb 

Ub 

Y 

Ua 

Ub 

Aa 

Oa 

Ua 

Ea 

Qb 

Ob 

Ub 

Aa 

Ga 

Ja 

R 

Tb 

Qb 
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Db S Da Eb Da Aa Ma Ka Nb Pb Vb La Ba Va D Pb Mb Yb H 

Ta Ab Qa Ha Ba Za Vb Yb Nb Ba Ma Va K Bb Yb Nb M Ja Lb 

Ra la Ta Wa Yb Eb Mb Ra Ca Aa Q Ab Ib Rb 0 Ja Tb Ma Ba 

Pa Da Ib Vb Jb Qa Ua Aa G Lb Sb Vb V La Ub Oa Ja Ma Wa 

Rb Lb Mb Wa Ja Da U Ub Kb Ib N Oa Ab Ma Ca Ha Pa Tb Nb 

Sb Ea La La J Eb Ob Lb F Ka Ib Oa Ba la Ga Kb Rb Tb Ra 

Ba Ja U Sb Hb Ub F Aa Yb Ba Ba Aa Sa Db Vb Jb Ba Va Ya 

Q Db Qb Eb C Ja Cb Aa Fa Ea Ka Tb Zb Mb Aa Ha Ea I Db 

Db Sb H Pa Cb Xa Ba Ga Va Hb Lb Mb La Da Ea G Tb Mb Eb 

Z La Ib Ba Na Va Pa Db Nb Db. 

Each of the above 19 coliomns represent letters which are enciphered 
with the same pin-setting of Wheel Length 19. In the case of a four- 
wheel HAGELIN CRYPTOGRAPH system, such as we have here, the letters 
within a column have come from eight different cipher alphabets; that 
is, they represent polyalphabeticity of eight alphabets. This, of 
course, is exactly the same situation as the previous phase of our 
solution when we were dealing with the 17 columns of Wheel Length 17. 

In the present situation, however, we have most of the letters 
within a column further sub-divided into two groups, those followed 
by a small-letter "a" and those followed by a small-letter "b". 

All the letters followed by an "a" have been enciphered with the same 
pin-setting of Wheel Length 17; and all the letters followed by a "b" 
have been enciphered with the same pin-setting of Wheel Length 17. 
Therefore, within one column (of the 19) all letters followed by an 
"a" have been enciphered with both the same pin-setting of Wheel Length 
17 and Wheel Length 19, causing these letters to result from but four 
cipher alphabets. The same holds true of the letters within the same 
column followed by the small-letter "b". Thus, within a column all 
letters followed by the same small-letter are the result of poi?5>4y- 
alphabeticity of four alphabets, the four alphabets being caused by the 
pin-settings of the remaining two wheels. Wheel Length 21 and Wheel 
Length 23. 

Our problem now is divide the 19 columns ihto two classes, which we 
shall arbitrarily term Class C and Class D, where one class represents 
one pin-setting of Wheel Length 19 and one class represents the other 
pin-setting of Wheel Length 19. This should be an easier problem than 
the previous problem of dividing the columns of Wheel Length 17 into 
two classes, for in this case we already have most of the letters in 
the two classes, A and B; and in matching columns we can "in effect" 
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match 52 letters against 52 letters, for each coliimn is comprised of 
both a 26-letter alphabet of Class A letters and a 26-letter alphabet of 
Class B letters. In the comparing of columnar frequency distributions, 
therefore, we shall simultaneously match from one column a 26-letter 
alphabet of Class A letters and a 26-letter alphabet of Class B letters 
with similar alphabets in another column. 


The frequency distributions of the 19 columns are as follows: 


#1 

"a" 

A 

B 

C 

D 

E 

F 

G 

H 

I 

J 

K 

L 

M 

N 

0 

p 

Q 

R 

S 

T 

U 

V 

w 

X 

Y 

Z 



2 

1 



1 


1 





1 


2 

1 

1 

1 

1 

1 

1 


1 

1 
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#19 


"a" ABCDEFGHIJKLMNOPQRSTUVWXYZ 

2 1 1 13 11 1111 311 

"b" ABCDEFGHIJKLMNOPQRSTUVWXYZ 

11 1 132 2111 1 11 


Instead of making every possible comparison of the frequency 

19 (19“1) 

distributions of the 19 columns, — - - = 171 comparisons, let us 

take the frequency distributions of only the first ten columns and 
see if we can divide the letters 05 these columns into two classes 
which we shall designate Classes C and D. 

In comparing Frequency Distribution #1 with Frequency Distribution 
#2, we may obtain the "siim of the cross-products*' as follows: 
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Sum of the cross-products: 4+2+1+1+1+1+1+1+1+6+2+3+2+3+1+2 - 32. 

In using the chi test earlier in this chapter, to match the frequency 
distributions of the letters in the 17 columns of Wheel Length 17, we 
obtained a quotient by dividing the "sum of the cross-products" by the 
"product of the lengths of the distributions being matched". 

Where the lengths of the distributions being matched are all 
approximately the same, the "sum of the cross-products" by themselves 
may be used as validity indexes for matching distributions. Therefore, 
in the present case we shall use only the "sum of the cross-products" 
to reach conclusions as to the validity of the frequency distributions 
being matched. 

Thus, with the chi test being made for each pair of frequency 
distributions of the first ten columns (of the total 19), results are 
as follows: 
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#1 + #2 = 32 
#1 + #5 = 24 
#1 + #8 = 35 


#1 + #3 = 29 
#1 + #6 = 24 
#1 + #9 = 15 


#1 + #4 = 25 
#1 + #7 = 35 
#1 + #10 = 31 


#2 + #3 = 23 
#2 + #6 = 31 
#2 + #9 = 20 


#2 + #4 = 23 
#2 + #7 = 35 
#2 + #10 = 35 


#2 + #5 = 29 
#2 + #8 = 40 


#3 + #4 = 25 #3 + #5 = 18 #3 + #6 = 23 
#3 + #7 = 13 #3 + #8 = 21 #3 + #9 = 23 
#3 + #10 = 18 


#4 + #5 = 12 #4 + #6 = 33 #4 + #7 - 22 

#4 + #8 = 24 #4 + #9 = 26 #4 + #10 = 26 


#5 + #6 = 32 #5 + #7 = 34 #5 + #8 - 32 

#5 + #9 = 24 #5 + #10 = 29 


#6 + #7 = 37 #6 + #8 = 27 #6 + #9 = 22 

#6 + #10 = 36 


#7 + #8 = 46 #7 + #9 = 20 #7 + #10 = 41 


#8 + #9 = 23 #8 + #10 = 36 


#9 + #10 = 29 


In analyzing the above — = 45 chi test results, to divide 

tli6 t©n dist]rii)Utions into tliG two ClassGS f C and. D / W6 must urGmsitibGir 
that the larger the "sum of the cross-products"/ the more likely it 
is that the pairs of distributions are in the same class; and 
conversely/ the lesser the "siam of the cross-products , the less 
likely it is that the pairs of distributions are in the same class. 
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The first step, obviously, is to make a distribution of the "sum of the 
cross-products" results. Such a tabulation shows: 

(1) the three lowest results are 12, 13, and 15. 

(2) the three largest results are 40, 41, and 46. 

(3) the average or median result is 26. 


As we must start somewhere 
indicate an incorrect match, 
correct match. We have then: 

Correct match 

#2 + #8 = 40 
#7 + #10 = 41 
#7 + #8 = 46 


smallest results 
three largest results indicate a 

Incorrect match 

#4 + #5 = 12 
#3 + #7 = 13 
#1 + #9 = 15 


let us assume that the three 
and that the 


From these matches we can see: 

(1) #4 and #5 are not in the same class. 

(2) #1 and #9 are not in the same class. 

(3) #2, #7, #8, and #10 are in the same class. 

(4) #3 is not in the same class as #2, #7, #8, and #10. 


Purely arbitrarily we can consider distributions #2, #7, #8gl and #10 
as being in Class C, and distribution #3 as in Class D. 


^distributions #4 and #5 are assumed not to be in the same class, 
us match these distributions 'then against distributions #2, #7, #8, 
#10 which are in the now designated Class C. 


#4 + #2 = 23 
#4 + #7 = 22 
#4 + #8 = 24 
#4 + #10 = 26 


#5 + #2 = 29 
#5 + #7 = 34 
#5 + #8 = 32 
#5 + #10 = 29 


Let 

and 


It appears that almost surely Distribution #5 is within Class C, while 
Distribution #4 is in Class D. At this point our classes, therefore, are: 
Class C: #2, #5, #7, #8, and #10. 

Class D: #3 and #4. 


Like distributions #4 and #5, distributions #1 and #9, above, are 
assxamed to be in different classes. Therefore, let us match these 
distributions against those of Class C. 
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#1 + #2 = 32 
#1 + #5 = 24 
#1 + #7 = 35 
#1 + #8 = 35 
#1 + #10 = 31 


#9 + #2 = 20 
#9 + #5 = 24 
#9 + #7 = 20 
#9 + #8 = 23 
#9 + #10 = 29 


From these results it visually appears certainly likely that 
Distribution #1 is within Class C and that Distribution #9 is within 
Class D. 


Finally, let us match the last unidentified distribution. Frequency 
Distribution #6 with the now presumed Classes C and D: 

Class C Class D 


#6 + #3 = 23 
#6 + #4 = 33 
#6 + #9 = 22 


#6 + #1 = 24 
#6 + #2 = 31 
#6 + #5 = 32 
#6 + #7 = 37 
#6 + #8 = 27 
#6 + #10 = 36 

In spite of (#6 + #1 = 24) and (#6 + #4 = 33), it appears probable 
that Distribution #6 belongs in Class C; and all ten columns have now 
been divided into the two Classes C and D as follows: 

Class C: #1, #2, #5, #6, #7, #8, and #10. 

Class D: #3, #4, and #9. 


To this point, we have demonstrated that the pin-settings of wheels 
in the HAGELIN CRYPTOGRAPH system can be recovered provided only that 
sufficient ciphertext is available for analysis; and in the case of a 
four-wheel HAGELIN system, 770 letters of ciphertext (in a single 
message) is enough to recover the pin-settings of the four wheels. With 
specific reference to the cryptogram of this chapter, we have to this 
point — 

(1) Recovered the pin-settings of most of the pins of Wheel Length 

17. 

(2) Recovered the pin-settings of the first ten pins of Wheel 
Length 19. 

The student who has followed closely the procedures so far should have 
no difficulty in completing the solution of the given cryptogram; and the 
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only thing he really needs is time I 

Before moving on to the next chapter, however^ let us wrap up / 
so-to^speak, what we have done so far, add a few important points, 
how to determine the number of **lugs on a wheel, etc. 

Consider the multiple alphabets generated by four wheels with 
respective lug-settings, for example, of 5, 4, 3, and 1: 


Wheel No. of Lugs 


1 

2 

3 

4 


5 

4 

3 

1 


Different Keys Generated 

0 5 

0 5 + 49 

0549+387 12 

0549387 12 +165 10 498 13 


The plus sign (+) represents the additional different keys generated 
by the additional wheel; but note that the additional wheel must be 
effective for the additional different keys to be generated* Thus, 
for example, if all of the pins of the additional wheel are to the left, 
in a non-effective position, there will be no additional different keys 
generated. 

In the first phase of the solution of the cryptogram of the present 
chapter, the frequency distributions of the 17 columns were divided into 
two classes, designated A and B. The letters of each column were thus 
found to be in either Class A or Class B. These classes, in essence, 
represented the "effectiveness** or "non-effectiveness" of the 17 pins 
of Wheel Length 17. Turning now to the above, for example, assuming 
Wheel 4 to be Wheel Length 17, Class A might represent the ciphertext 
letters generated from the eight alphabets 054938712. Class A 
would thus indicate a **non-effectiveness** of Wheel Length 17. Conversely, 
Class B ciphertext letters would then represent letters generated from 
the second eight alphabets, these keys being generated from the 
"effectiveness" of pins on Wheel Length 17. 

Several things should be noted especially about these two pairs: of 
eight alphabets, 0549387 12 and 1 6 5 10 4 9- 8 13. First, one of 
eight alphabets will always contain the key number 0. Second, the 
second of thei eight alphabets is the same as the first plus a number 
representing the number of "lugs" on the wheel. 

How can we use these facts to our advantage? If one of the eight 
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always contains the key number 0, we might expect that the ciphertext 
letters A and V, representing the plaintext letters Z and E enciphered 
with a key of 0, to occur with some degree of frequency within the class 
representing the eight alphabets generated by a non-effective pin on the 
wheel. Therefore, let us examine the frequency distributions of all the 
Class A letters and all the Class B letters from Wheel Length 17. 


Class A - (columns 1, 2, 6, 1, 8, 14, 16, 17) 
ABCDEFGHIJKLMNOPQRSTUVWXYZ 

ti%%%%%% 

$i - * ' ' ? 



Class B - (colvunns 3, 4, 5, 10, 11, 12, 15) 

ABCDEFGHIJKLMNOPQRSTUVWXYZ 

i- MS' n 

% * - f 


As the Class A distribution, above, contains a large number of A*s and 
V*s, it is likely that Class A does represent the eight alphabets contain¬ 
ing the key number 0. The Class B distribution would then represent the 
second eight alphabets, i.e., the first eight alphabets plus a number 
representing the number of "lugs" on Wheel Length 17. 

Can we find now the "lug-setting" of Wheel Length 17? Using the fact 
that Class A + number of "lugs" on Wheel Length 17 = Class B, we can 
attempt to shift the Class A distribution to the right so that it will 
equal the Class B distribution, the number of shifts being the nxmiber of 
"lugs" on Wheel Length 17. Visually, it is seen that shifting the Class 
A distribution to the right three positions will make the two distributions 
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generally equal, as follows: 


Class A - (columns 1^ 2, 6, 7, 8, 14, IS, 17) 
XYZABCDEFGHIJKLMNOPQRSTUVW 



II 

t- ^ 


Class B - (columns 3, 4, 5, 10, 12, 15) 
ABCDEFGHIJKLMNOPQRSTUVWXYZ 

1 = t- 

t 

$ ' ' 


It is likely, therefore, that there are three lugs on Wheel Length 17, 


The student probably clearly understands now what the Classes A and 
B represent. But what of the Classes C and D which were involved with 
Wheel Length 19? 

Let us return again to the example generation of multiple alphabets 
with the four lug-settings, 5, 4, 3, and 1: 


Wheel 

1 

2 

3 

4 


No. of Lugs Different keys generated 

5 0 5 

4 0 5 + 4 9 

3 0549+387 12 

1 0549387 12 + 165 10 498 13 


In this example, if Wheel Length 17 were Wheel 4, Class A = 0 5 4 9 
3 8 7 12 and Class B=1651049813. Assuming Wheel Length 19 = 
Wheel 3, what different keys are represented by Classes C and D? 

As above, let us this time show Wheel 3 as the final wheel: 
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Wheel 


ISlo. of Lugs 


Different keys generated 


1 


2 


4 


3 


5 


4 


1 


3 


0 5 

0 5 + 49 

0549 + 165 10 

0549165 10 + 387 12 498 13 


Here, Wheel 3 divides the "different keys generated" into the two 
classes C and D, with C=05491651O and D = 3 8 7 12 4 9 8 13, or 
vice versa. To better show the relationship between the four classes, 

A, B, C, and D, let us break the different keys generated by each class 
into two halves, as follows: 


A=0549 + 387 12 
B=165 10 + 498 13 
0 = 0549 + 165 10 
0=387 12 + 498 13 


In the above, for example, if an unknown ciphertext letter is known 
to be in both Class A and Class C, its key will be one of the four, 
0549. Similarly, a ciphertext letter known to be in Class B and 
Class D must be one of the four keys, 4 9 8 13. 

Thus, in the first phase of our solution we succeeded in dividing most 
of the ciphertext letters into the two Classes A and B. In the second 
phase we divided the same ciphertext letters into the two Classes C and D 
with the assistance of knowing that half of the letters in Class C were 
in Class A with the other half in Class B, and similarly, that half of 
the letters in Class D were in Class A with the other half in Class B. 

By this time, the student should have a good idea of what we have 
been doing, how a straight mathematical or statistical analysis of an 
unknown HAGELIN cryptogram operates, etc. We will not continue with the 
solution of the given cryptogram, since the process is downhill from this 
point. However, it would be desirable for the student himself to 
complete the solution, for in the final analysis one can only really 
learn by doing. 

In the problems that follow, all have been enciphered with four 
effective wheels of the HAGELIN CRYPTOGRAPH. 
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PROBLEMS 


41. 


Wheel- 

-Lengths; 

; 23, 

r 21, 

19, 

, 17. 













E 

T 

C 

K 

Q 

G 

D 

K 

N 

J 

P 

R 

W 

K 

F 

U 

Q 

p 

M 

G 

M 

A 

G 

D 

F 

T 

A 

X 

K 

I 

Y 

U 

I 

J 

E 

F 

B 

C 

N 

P 

K 

S 

D 

Z 

Z 

Q 

A 

Q 

J 

A 

M 

U 

Y 

L 

F 

P 

M 

Y 

F 

W 

B 

Z 

V 

J 

K 

S 

Y 

M 

S 

K 

K 

P 

J 

V 

T 

I 

P 

P 

M 

A 

D 

U 

V 

X 

J 

K 

J 

V 

I 

E 

B 

E 

N 

I 

Z 

E 

Q 

J 

U 

D 

V 

Y 

T 

Y 

C 

J 

A 

U 

W 

L 

R 

D 

Y 

N 

S 

A 

B 

B 

H 

V 

V 

Z 

A 

A 

D 

H 

U 

V 

V 

F 

G 

P 

T 

R 

P 

K 

V 

V 

E 

W 

G 

E 

D 

U 

R 

F 

F 

I 

G 

J 

P 

J 

D 

R 

I 

L 

E 

W 

N 

L 

R 

M 

R 

Z 

J 

S 

M 

C 

L 

N 

C 

Z 

Q 

A 

0 

H 

E 

0 

S 

M 

N 

D 

W 

R 

V 

J 

Z 

W 

V 

W 

G 

V 

0 

U 

Z 

S 

Y 

I 

R 

C 

Z 

Q 

J 

Q 

P 

0 

U 

I 

I 

Q 

A 

T 

L 

I 

S 

Y 

H 

K 

N 

J 

N 

Y 

Y 

L 

I 

G 

U 

E 

R 

0 

Y 

T 

J 

A 

V 

B 

N 

Y 

D 

W 

C 

C 

D 

F 

L 

U 

0 

B 

R 

F 

J 

P 

F 

D 

R 

W 

F 

R 

V 

U 

X 

X 

Y 

A 

N 

0 

Q 

L 

U 

A 

E 

A 

D 

J 

A 

F 

z 

Q 

Z 

L 

z 

N 

H 

Y 

J 

P 

L 

V 

T 

J 

V 

I 

Y 

Y 

X 

D 

Q 

U 

X 

T 

U 

M 

H 

R 

N 

E 

W 

S 

J 

0 

0 

A 

B 

U 

G 

F 

Y 

S 

D 

N 

Q 

D 

B 

B 

X 

Z 

0 

N 

H 

A 

R 

E 

V 

Q 

M 

J 

A 

V 

X 

Z 

R 

V 

F 

W 

K 

J 

Q 

A 

S 

Y 

N 

J 

D 

F 

U 

A 

A 

J 

G 

Y 

u 

A 

Y 

u 

Z 

D 

M 

E 

M 

D 

H 

H 

S 

N 

L 

C 

L 

V 

U 

U 

R 

0 

Z 

K 

0 

D 

F 

Z 

c 

I 

F 

V 

J 

E 

X 

U 

W 

I 

Y 

A 

W 

E 

V 

X 

0 

J 

Y 

A 

Q 

J 

R 

Y 

M 

X 

V 

G 

0 

0 

Z 

Q 

F 

Z 

V 

A 

U 

L 

A 

Y 

Q 

C 

C 

0 

N 

s 

E 

H 

H 

Z 

u 

L 

0 

M 

G 

U 

Q 

G 

P 

N 

X 

W 

Y 

D 

E 

R 

G 

C 

N 

Q 

s 

F 

0 

F 

I 

Y 

P 

T 

D 

M 

E 

E 

H 

R 

Z 

J 

P 

P 

N 

B 

K 

J 

C 

L 

M 

F 

I 

P 

E 

w 

L 

H 

K 

F 

E 

0 

S 

F 

G 

P 

V 

L 

N 

F 

M 

E 

T 

S 

G 

Y 

D 

I 

X 

N 

D 

H 

X 

P 

R 

J 

A 

Q 

E 

A 

H 

0 

X 

U 

D 

D 

Z 

P 

V 

J 

W 

K 

E 

D 

P 

D 

D 

Q 

E 

D 

R 

A 

R 

V 

Z 

J 

H 

X 

0 

U 

E 

J 

E 

D 

F 

V 

A 

A 

0 

0 

M 

T 

w 

Z 

M 

B 

P 

G 

K 

K 

V 

A 

E 

R 

P 

Z 

I 

V 

Y 

Y 

c 

Q 

Y 

I 

N 

R 

F 

A 

Q 

R 

X 

U 

P 

V 

A 

S 

K 

J 

D 

0 

S 

N 

0 

M 

J 

D 

M 

K 

L 

E 

I 

E 

L 

M 

M 

A 

E 

A 

E 

R 

H 

T 

I 

A 

I 

L 

A 

R 

R 

H 

N 

0 

V 

P 

J 

K 

F 

N 

D 

A 

A 

U 

I 

K 

L 

M 

U 

B 

P 

0 

E 

A 

P 

U 

M 

N 

Y 

A 

Z 

J 

V 

N 

P 

J 

F 

W 

G 

Z 

L 

E 

V 

Q 

C 

B 

E 

H 

T 

F 

S 

H 

F 

D 

U 

J 

L 

0 

S 

U 

T 

K 

G 

X 

J 

R 

K 

G 

M 

Y 

M 

N 

U 

R 

I 

J 

A 

I 

S 

J 

F 

T 

B 

Y 

D 

Y 

Q 

K 

E 

J 

K 

P 

U 

K 

K 

N 

Y 

M 

M 

0 

F 

J 

Z 

V 

D 

D 

S 

U 

B 

H 

U 

Q 

L 

P 

K 

C 

R 

Z 

A 

R 
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M T K C S 


42. 


43. 


44. 


J 

R 

R 

Z 

I 

A 

u 

I 

T 

R 

L 

X 

K 

E 

Y 

Z 

R 

I 

S 

N 

M 

K 

W 

Q 

E 

Q 

B 

T 

I 

D 

R 

0 

Z 

F 

D 

Z 

N 

R 

J 

Q 

R 

W 

N 

Y 

S 

X 

I 

H 

P 

Z 

N 

E 

Q 

W 

F 

N 

C 

H 

P 

A 

A 

S 

V 

F 

N 

G 

0 

W 

V 

Z 

I 

Q 

0 

0 

I 

I 

K 

V 

E 

I 

Q 

R 

T 

R 

M 

0 

A 

N 

E 

U 

J 

z 

N 

J 

M 

D 

F 

P 

I 

A 

G 

R 

F 

D 

D 

Q 

Z 

J 

J 

N 

I 

E 

N 

D 

F 

0 

Y 

H 

E 

Y 

J 

P 

0 

N 

W 

u 

A 

C 

A 

V 

P 

L 

0 

N 

0 

Z 

U 

D 

Q 

T 

J 

B 

Q 

S 

E. 

















W Y Y N R 

Y U P Q N 
R T N R U 
E D Y V T 

V Z K A R 
J J H A V 
G R T R Z 

Wheel-Lengths 23, 21, 19, 
initial "wheel settings"; 


17; Both messages enciphered with same 
Probable words: "ENEMY", "COMMAND", 


"MESSAGE", 

f 

’STOP", 

"FOR" 

1 

r 

"TO" 

• 















No. 1 - D 

0 

D 

F P 

M 

Y 

I 

T 

R 

W 

D 

E 

G 

G 

0 

V 

M 

E 

Y 

K 

A 

S 

C 

R 

V 

I 

A 

X I 

M 

I 

B 

T 

V 

Y 

D 

X 

L 

0 

H 

N 

M 

R 

D 

A 

A 

T 

U 

G 

B 

z 

L 

U J 

0 

M 

N 

T 

X 

V 

B 

I 

A 

U 

S 

Y 

Z 

L 

I 

G 

Z 

P 

E 

V 

U 

D 

Z 

J F 

B 

Z 

0 

Z 

G 

W Q 

R 

C 

M 

N 

G 

D 

A 

J. 






No. 2 - K 

0 

B 

B M 

M 

G 

N 

D 

T 

K 

K 

X 

D 

F 

I 

L 

I 

J 

I 

U 

N 

Z 

C 

R 

C 

S 

M 

Y J 

Q 

C 

B 

Z 

K 

W 

Q 

B 

S 

A 

T 

Z 

F 

U 

D 

D 

M 

S 

Q 

F 

P 

B 

0 

M P 

T 

L 

N 

C 

Y 

I 

S 

B 

W 

G 

0 

R 

A 

K 

P 

G 

J 

N 

Q 

Z 

0 

D 

M 

C N 

C 

R 

L 

Z 

S 

c 

F 

L 

H 

A. 











Wheel-Lengths: 

26, 

25, 

23, 

21; 

Message begins: 

II 

'SITUATION 

REPORT" 


Probable words: "KILLED", "WOUNDED", "MISSING". 


u u 

T 

M 

H 

T 

S 

T 

P 

F 

R 

Y 

Y 

R 

J 

0 

P 

S 

M 

V 

R 

G 

D 

Q 

Y 

M N 

F 

A 

A 

A 

I 

S 

B 

Y 

C 

N 

P 

U 

B 

A 

Y 

E 

A 

P 

G 

B 

B 

T 

Y 

T A 

D 

E 

L 

R 

0 

U 

C 

I 

X 

A 

A 

L 

Y 

A 

E 

V 

A 

V 

H 

F 

S 

T 

P. 

Wheel- 

-Lengths: 

25, 

23, 

21, 

19; 

Message begins: 

"INTELLIGENCE 

Probable words: 

"MESSAGE", 


"INTERROGATION' 

1 

f 

"ORDER OF 

BATTLE' 

Z M 

P 

V 

X 

U 

X 

B 

H 

U 

Y 

B 

E 

T 

B 

Q 

R 

0 

T 

D 

X 

M 

M 

0 

E 

Q B 

M 

P 

W 

N 

C 

R 

P 

B 

B 

S 

M 

Y 

E 

E 

T 

J 

G 

V 

J 

Y 

Y 

A 

J 

X T 

S 

G 

z 

V 

G 

Q 

J 

C 

L 

T 

S 

I 

P 

P 

M 

T 

U 

G 

M 

E 

L 

M 

K 

Q R 

L 

W 

X 

C 

Q 

N 

M 

V 

C 

D 

P 

D 

X 

F 

E 

J 

C 

L 

H 

W 

A 

B 

X 

X z 

P 

V 

T 

I 

H 

Z 

R 

Z 

H 

C 

U 

X 

K 

F 

X 

P 

V 

H 

G 

R 

X 

0 

Q 

V P 

N 

M 

U 

J 

B 

S 

A 

C 

0 

A 

S 

R 

B 

A 

M 

D 

I 

Y 

E 

L 

I 

B 

N. 
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45. 


X M T H 0 
T J D P U 
B K Y P B 


E M G T S 
T J A E A 
E I D Z T 


Wheel-Lengths: 23, 21, 19, 17; Message begins: "WEEKLY SITUATION 
REPORT"; Probable words; "KILLED", "MISSING": "WOUNDED". 

NCJPJ IICRS WEXWX 

DNPEX DSAIV YIEDF 

DXDRA BPLVD XQFAK 

R D Y D M. 

46. Wheel-Lengths: 23, 21, 19, 17; Message begins: "REQUEST"; Probable 
words: "STOP", "TO", "OF". 

YCSKY AQLSB SXXVO FSRQM YNCCP 

UCYQG EPGHE UDCBP MNCYX YJFZA 

RXKTA YWHRE KHZLA DPGMH UDGPS 

B A V Q :Q.; 

V 

Probable words; "PRISONER OF WAR", "TO", "ENEMY". 


47. 


M L J, V P 
K T U A A 
M I O X L 


T B P B J 
K A S O R 
F C B O F 


R W B S N 
J U L Y K 
A M F V K 


S C O A S 
V T V V F 
H X P O X 
L J O Z S 


T H S A L 
R C C J J 
W K W P T 
A J A I M 


HLULS PRCFD CDZDQ 
O I Z V C. 

48. Wheel-Lengths: 23, 21, 19, 17; Both messages enciphered with same 

initial "wheel settings"; Probable words: "ENEMY", "STOP", "ATTACK . 


No. 

1 

- K C 

F 

N 

K 


K 

K 

L F J 

U 

0 

K B 

I 


0 

Q 

P V V 

D 

C 

A 

E 

N 



M B 

V 

V 

W 


X 

I 

V C G 

I 

N 

K X 

X 


I 

s 

MAY 

T 

G 

M 

L 

Y 



G W 

G 

V 

I 


M 

B 

L N K 

E 

L 

I P 

M 


W 

T 

I Y H 

J 

I 

F 

T 

Q 



Z I 

D 

C 

A 


J 

W 

B J B 

F 

Y 

P A 

L. 










No. 

2 

- Z Y 

V 

Y 

I 


I 

C 

D S Q 

J 

R 

K D 

H 


w 

P 

W X G 

A 

P 

G 

X 

c 



N M 

Y 

B 

A 


A 

s 

Y L A 

E 

J 

U C 

0 


A 

H 

F Z G 

T 

P 

Q 

K 

0 



H J 

G 

E 

R 


H 

A 

Y A T 

X 

B 

D P 

Q. 










Wheel- 

■Lengths: 

: 23, 

21, 


19, 17; 

Probable 

words: 


"HEADQUARTERS" 

/ 


"INFORMATION" 

1 

f 

'ENEMY 

ATTACK". 














Z V 

0 

Y E 

D 

V 

w 

z 

G 


L A A 

A X 


E T 

E 

P 

A 


UFO 

X T 





R J 

D 

Z R 

F 

V 

H 

J 

D 


A J N 

P T 


Z X 

Z 

C 

I 


Y I X 

M 0 





V K 

R 

F G 

M 

K 

0 

L 

L 


H T C 

0 D 


E Q 

R 

T 

J 


U D B 

N J 





M V 

0 

F Q 

F 

X 

R 

R 

P 


JAN 

I K 


J R 

Q 

A 

0 


S A R 

E W 





Z F 

P 

V R 

U 

X 

F 

N 

I 


J B N 

C F 


F I 

Q 

G 

M 


W K J 

W F 

• 
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"STOP 


50. Wheel-Lengths: 23, 21, 19, 17; Probable words: "MESSAGE", 
"YOUR". 


X 

A 

X 

H 

M 

C 

C 

A 

G 

V 

z 

V 

C 

H 

S 

W 

D 

J 

I 

V 

Q 

S 

I 

Q 

B 

w 

Y 

L 

P 

H 

B 

U 

M 

0 

P 

w 

D 

I 

L 

D 

A 

V 

U 

Q 

G 

B 

C 

G 

u 

M 

V 

D 

A 

G 

F 

G 

E 

A 

A 

T 

Y 

V 

Z 

M 

H 

V 

R 

R 

I 

V 

D 

U 

H 

I 

G 

w 

H 

H 

A 

P 

G 

I 

B 

C 

S 

F 

M 

X 

E 

J 

G 

F 

B 

0 

U 

M 

S 

U 

H 

E 
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Chapter 6 


ANALYSIS OF A FIVE-WHEEL HAGELIN CRYPTOGRAPH 

We have now reached the next-to-last stepping stone in our study of 
the cryptanalysis of the HAGELIN CRYPTOGRAPH. In this chapter we shall 
consider the cryptanalysis of a five-wheel HAGELIN CRYPTOGRAPH. 

Let us consider the solution of the following cryptogram, enciphered 
with five wheels of lengths 17, 19, 21, 23, and 25. At the same time, 
to facilitate solution, and to better introduce the student to the 
principles of plri'-setting and lug^settlng reconstruction from recovered 
generated key, let us be given also the stereotype message beginning 
(in this case) of "TO COMMANDING GENERAL FIFTH TASK FORCE". 


The cryptogram — 


A U G J S 
X Z F K N 
F V C S P 
S Z N W I 


R E C S A 
L X M A A 
Y N S Q E 
Z P I X E. 


I R T U T 
N D C O K 
I V O R C 


HPANM FIDBU 
TOMJR KSRDI 
WEHCP EFFHW 


Given ciphertext with a knowledge of plaintext, generated key may be 
recovered: 

Plaintext: tozcommandingzgener 

Ciphertext: AUGJSRECSAIRTUTHP AN 

Key: 209 6 127 4 173 6 4 175 0 200 123 5 5 

alzfifthztaskzforce 

MFIDBUXZFKNLXMAANDC 

13 17 8 9 10 0 17 7 5 4 14 4 8 12 6 15 5 6 7 

z 

O 

14 


The recovered generated key looks good! As no individual key is over 
20, it appears likely that even with all five wheels effective, the 
maximum sum of the lugs is not over 20. 

From this partially recovered generated key let us attempt to determine 
the pin-settings of the five wheels, as well as the number of lugs on 
each wheel. 
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The first step is to "lay out" the recovered key, similar to the 
manner described in Chapter 4 as follows: 


Recovered key: 

20 9 6 12 7 4 17 3 6 4 17 5 0 20 0 12 3 5 5 

(17: 

Wheel ^ 21 . 

Length 

(25: 

T~~n 

1 





1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 



It is noted that the individual keys consist of numbers from 0 to 20. 
The key 0 obviously has arisen from non-effective pins on all five wheels; 
and there is the strong likelihood, conversely, that the key 20 has arisen 
from effective pins on all five wheels. Therefore, in the above "form" 
we may indicate a non-effective pin with a minus sign (-) and an effective 
pin with a plus sign (+) as follows: 




With the "effectiveness" or "non-effectiveness" of pins determined 
for those positions of the recovered key where the key is 0 or 20, 
the now determined pins may be "marked" or indicated throughout the 
form as follows: 
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20 9 6 12 7 4 17 3 

6 4 17 5 0 

20 0 12 3 5 5 13 17 

17: 

+ 

- 

F- 

19: 

+ 

- 

F- 

21: 

+ 

- 

T-::--1 

23: 

+ - 

- 

+ - 

25: 

+ 

- 

+ - 


1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 



At this point let us attempt to find a wheel containing an abnormal 
large number of lugs; and thereafter, to determine the pin-settings for 
the wheel. 


We begin by writing the recovered key horizontally in a "period" 
fashion for each of the five wheel lengths. At the same time we note 
the differences between the largest and smallest key number in each 
pin position as follows: 


Wheel Length 17 — 


20 9 6 12 7 4 17 3 6 4 17 5 0 20 0 12 3 

5 5 13 17 8 9 10 0 17 7 5 4 14 4 8 12 6 

15 5 6 7 14 _ 

15 4 7 10 7 5 7 3 11 3 12 1 14 16 8 0 3 

Wheel Length 19 — 

20 9 6 12 7 4 17 3 6 4 17 5 0 20 0 12 3 5 5 

13 17 8 9 10 0 17 7 5 4 14 4 8 12 6 15 5 6 7 

]A ___ 

7 8 2 3 3 4 0 4 1 0 3 1 8 8 6 3 2 I 2 

Wheel Length 21 — 

20 9 6 12 7 4 17 3 6 4 17 5 0 20 0 12 3 5 5 13 17 

8 9 10 0 17 7 5 4 14 4 8 12 6 15 5 6 7 14 _ 

12 0 4 12 10 3 12 1 8 0 9 7 6 5 5 6 4 9 

Wheel Length 23 — 

20 9 6 12 7 4 17 3 6 4 17 5 0 20 0 12 3 5 5 13 17 8 

10 0 17 7 5 4 14 4 8 12 6 15 5 6 7 14 _ 

To ' 9 11 5 2 0 3 i 2 8 11 10 5 14 7 2 


9 
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Wheel Length 25 — 

20 9 6 12 7 4 17 3 6 4 17 5 0 20 0 12 3 5 5 13 17 8 9 10 0 

17 7 5 4 14 4 8 12 6 15 5 6 7 14 __ 

3218 11 0990 11 12 17 6 

It is seen that the wheel length with the smallest differences between 
the largest and smallest key number within each position when the recovered 
key is written horizontally in wheel length "period" fashion is Wheel Length 
19 where the largest difference in any position is eight. 

Thus, it appears that Wheel Length 19 contains a relatively large number 
of lugs I And with this knowledge we can tenatively designate each position 
of Wheel Length 19 as "effective" or "non-effective" as follows: 

20 9 6 12 7 4 17 3 6 4 17 5 0 20 0 12 3 5 5 

13 17 8 9 10 0 17 7 5 4 14 4 8 12 6 15 5 6 7 

14 

Examining the "keys" produced by the "effectiveness" or "non-effectiveness" 
of Wheel Length 19 indicates that the probable number of lugs on Wheel Length 
19 is nine! That is, an effective pin on Wheel Length 19 has added or 
contributed "9" to the generated key. 

We may now return to the initial recovered key "form" and insert in 
Wheel Length 19 the value of "9" for an effective pin and the value of "0" 
(which is the same as a minus sign) for a non-effective pin as follows: 


20 9 6 12 7 4 17 3 6 4 17 5 0 20 0 12 3 5 5 13 17 


17: 

+ 

- + 

- 


19: 

99090090 

0 0 9 0 0 9 

0 9 

^ _ 

0 0 0 19 9 

21: 

+ 

- + 

- 

□ 

23: 

+ - 

- + 

- 


25: 

+ 

- + 

- 



1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 


8 

9 

10 

0 

17 

7 

5 

4 

14 

4 

8 

12 

6 

15 

5 

6 

7 

14 




- 





- 

+ 

- 


1 

[± 





0 

9 

0 

0 

9 

0 

0 

0 

9 

0 

0 

9 

0 

9 

0 

0 


|9 

+ 



- 









- 

+ 

- 





-j 

1+ 

- 











- 

+ 

- 





- 

F~ 












- 

+ 

22 

23 

24 

25 

26 

27 

28 

29 

30 

31 

32 

33 

34 

35 

36 

37 

38 

39 
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Examining the now partially completed recovered key "form", position 
2 with its key of 9 is noted. As the pin of Wheel Length 19 in this 
position has contributed its value of 9 to the total resultant key of 9, 
the pins of the other wheels in this position must be non-effective. 
Position 2 of Wheel Length 17, thus, must be non-effective; but note 
position 36 with its key of 5. The pin of Wheel Length 17 in position 2 
is the same pin of Wheel Length 17 in position 36. If this pin is 
non-effective, in position 36 the key of 5 must come completely from 
Wheel Length 25, as the pins of the other wheels in this position are 
also non-effective. We can say, therefore, that the number of lugs on 
Wheel Length 25 is five! 

The recovered key "form", with the pins now identified in position 
2 (and in position 23 with its total key of 9), and with the value of 
5 being inserted for each effective pin in Wheel Length 25, now appears 
as follows: 
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As Wheel Length 25 contains five lugs, in those positions where the 
total generated key is less than five. Wheel Length 25 must be non-effective. 
Thus, in positions 6, 8, 10, 17, 29, and 31, Wheel Length 25 must be 
non-effective. Position 18 is noted: since Wheel Length 17 is effective, 
unless this wheel is completely overlapped by Wheel Length 25 (which is 
known to contain five lugs ), Wheel Length 25 must be non-effective. 

These new identifications may be added to the recovered key "form" in 
all their relative positions; and the "form" to this point appears as 

follows: 
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In looking at the now partially completed form, positions 6 and 8 are 
noted. In position 6, Wheel Lengths 21 and 23 together equal 4; and in 
position 8, the same two wheels equal 3. Thus, the number of lugs on 
Wheel Lengths 21 and 23 must be one of the following: 

21 23 


(a) 

(b) 

(c) 

(d) 


3 

3 
1 

4 


Position 38 is noted. Wheel Lengths 17 and 21 together add up to 7. 
Therefore, assuming that there is not more than a two lug overlap between 
Wheel Length 17 and 21, Wheel Length 17 "possibilities" may be added to 
the cases (a) (b) (c) (d), above, as follows: 

21 23 17 


(a) 

(b) 

(c) 

(d) 


3 

3 
1 

4 


1 

4 

3 

3 


4/5/6 

4/5/6 

6/7 

3/4/5 


Position 31 now provides some valuable information. The number of lugs 
on Wheel Length 17 cannot be over four, as the pin of Wheel Length 17 is 
"effective" in position 31 and the total key in the same position is 4. 
Thus, case (c), above, where Wheel Length 17 is shown with 6 or 7 lugs, is 
impossible; and with Wheel Length 17 containing not over four lugSr the 
remaining cases can only be as follows: 
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21 23 17 

(a) 3 1 4 

(b) 3 4 4 

(d) 4 3 3/4 

Can Wheel Length 17 contain three lugs? In position 31 it is seen 
that the pin of Wheel Length 17 is "effective" and the total key is 4. 

If Wheel Length 17 in this position contains three lugs, one additional 
lug must be provided by either Wheel Length 21 or Wheel Length 23 to 
yield the total 4. But in case (d) above, where Wheel Length 17 is 
shown with three possible lugs, neither Wheel Length 21 nor Wheel 
Length 23 has one lug I Therefore, unless there is the sizable 
overlap of two or three lugs. Wheel Length 17 must contain four lugs. 

Continuing, in positions 1 and 14 it is seen that with "effective" 
pins on all wheels, the total key is 20; and here we are following the 
premise that the largest evident key has come from the condition of 
the pins of all wheels being "effective". With nine lugs on Wheel Length 
19 and five lugs on Wheel Length 25, if case (a) above is valid, there 
will be a total overlap "between all wheels" of two lugs. If either case 
(b) or (d), however, is valid, there will be a total overlap "between all 
wheels" of five lugs. Since it is unlikely that there would be an 
overlap of five lugs between five wheels with such small lug-settings, 
only case (a) above can be assumed to be valid. Moreover, if it is 
assumed that each wheel has a different number of lugs, only case (a) 
provides a different number of lugs for each wheel. 

The probability is, then, that Wheel Length 17 contains four lugs, 
that Wheel Length 21 contains three lugs, and Wheel Length 23 one lug. 

The recovered key "form" may be revised as follows: 
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From this point, analysis becomes fairly simple. Position 4, for 
example, indicates that Wheel Length 17 is "effective" (with four lugs) 
in this position; and in order to obtain a generated total key of 12, 
there must be an "overlap" between Wheel Length 17 and Wheel Length 19 
of one lug. Position 39 indicates that Wheel Length 17 is "non- 
effective" in this position, which in turn indicates that position 5 
of Wheel Length 17 is likewise "non-effective"; and with Wheel Length 
17 "non-effective" in position 5, the generated total key of 7 in the 
position can only come from the pins of Wheel Lengths 21 and 25 being 
"effective" in the position and there being also an "overlap" of one 
lug between Wheel Length 21 and Wheel Length 25. 

Thus, complete recovery of the pin-settings and lug-settings of 
all five wheels is practically assured; and the remaining letters of 
the cryptogram can easily be read. Completing solution is left to the 
student. 

Before proceeding to Chapter 7, the student should attempt to gain 
proficiency in the art of recovering pin-settings and lug-settings from 
partially recovered key by solving several of the problems that follow. 

PROBLEMS 

51. Wheel-Lengths: 25, 23, 21, 19, 17; Messages enciphered with same 
initial "wheel settings"; Probable words: "ATTACK", "REQUEST", 
"ENEMY", "STOP", "FOR", "TO". 
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RQFMW OHNLO GHWJH MTGKA HXNWX 
QICPC AINDV PLEYI WPMDM SCUGL 
R O V Q Q. 

52. Wheel-Lengths: 26, 25, 23, 21, 19; Message beginning: "WEEKLY 
SITUATION REPORT NUMBER STOP". 
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53. Wheel-Lengths: 25, 23, 21, 19, 17; Message begins: "PRISONER OF 
WAR INTERROGATION REPORT NUMBER ". 
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54. Wheel-Lengths: 25, 23, 21, 19, 17; Probable words:"ARTILLERY", 

"ENEMY"; Messages enciphered with same initial "wheel settings." 
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55. Wheel-Lengths: 25, 23, 21, 19, 17; Message ends; STOP SIGNED 
GENERAL WILLIAM DELGADO. 
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Chapter 7 


ANALYSIS OF THE SIX-WHEEL HAGELIN CRYPTOGRAPH 
WHERE INDICATORS ARE UNENCIPHERED 

We at last have arrived at the problem of solving the six-wheel HAGELIN 
CRYPTOGRAPH; but in this chapter we shall be given the added "assist" or 
"advantage" of knowing the initial wheel-settings of messages. Thus, from 
unenciphered indicators we shall know exactly which portions of the keying 
sequence, running from 1 to 101405850, have been used to encipher given 
messages. 

Consider the solution of the following three cryptograms enciphered 
with a Model Type C-48 HAGELIN CRYPTOGRAPH: 
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A 

A. 





















The three messages might have been selected from "traffic" perhaps 
consisting of hundreds of messages, or we might simply have been given 
these three messages. In any case, the messages have been selected to 
deliberately present a situation for the purpose of instruction which 
could arise using the HAGELIN CRYPTOGRAPH. Further — and we need to 
keep in mind that these messages have been constructed for instructional 
purposes — let us be given the following known facts: 

(1) Each message begins with the word "MESSAGE" followed by one or 
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more niambers and the word "STOP". 

(2) The first two five-letter groups of each cryptogram are 
indicator groups, where — 

(a) The first six letters are the unenciphered initial setting 
of the six HAGELIN CRYPTOGRAPH wheels used to encipher the message. 

(b) The seventh through tenth letters indicate the number of 
letters in the message, where A=l, B=2, C=3, etc. Thus, for 
example, in Message No. 1 the seventh through tenth letters are J J I E. 
These letters represent 0095, meaning that the message consists of 
95 letters. 

The message indicators representing the initial wheel settings of 
the messages, thus, are: 

No. 1- JYBTMH 
No. 2 - OEJIFE 
No. 3 - WLOLGD 

The first letter of the indicator represents the wheel-setting of 
Wheel Length 26, the second letter represents the wheel-setting of 
Wheel Length 25, etc. 

As the lengths of the six wheels are 26, 25, 23, 21, 19, and 17, 

there are 26 x 25 x 23 x 21 x 19 x 17 = 101,405,850 possible different 

"starting points" for the encipherment (or decipherment) of messages. 
Each "starting point" is represented, thus, by a different initial 
setting of the six wheels; and as the six wheels turn in progression, 
letters are enciphered (or deciphered) at progressive points along the 
generated key which is 101,405,850 positions in length. 

Our first cryptanalytic task is to convert the above literal 
indicators into successive numerical indicators} that is, we want to 
convert the wheel-setting A A A A A A, for example, into 1, the wheel¬ 
setting B B B B B B into 2, C C C C C C into 3. . . Z Z X U S Q into 

101,405,850, etc. 

One might visualize, thus, that the 101,405,850 indicators represent 
101,405,850 successive positions of generated key; and with successive 
numerical indicators we shall be able to easily see at which points 
along the 101,405,850 positions of generated key the various messages 
have been enciphered. 
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The problem of converting literal indicators to successive 
numerical indicators is mathematically not very difficult; and using 
a "computer" the problem is even less difficult. But the manual 
conversion process is best described as cumbersome and time consuming! 

The process is as follows: 

(1) The first step is to replace the letters of the indicators 
with numbers which represent the positions of the letters on their 
respective wheels as shown below — 


Wheel-Length 

26 25 23 21 19 17 


A 

= 

1 

A 

= 

1 

A 

= 

1 

A 

= 

1 

A 

= 

1 

A 

= 

1 

B 

= 

2 

B 

= 

2 

B 

= 

2 

B 

= 

2 

B 

= 

2 

B 

= 

2 

C 

= 

3 

C 

= 

3 

C 

= 

3 

C 

= 

3 

C 

= 

3 

C 

= 

3 

D 

= 

4 

D 

= 

4 

D 

= 

4 

D 

= 

4 

D 

= 

4 

D 

= 

4 

E 

= 

5 

E 

= 

5 

E 

= 

5 

E 

= 

5 

E 

= 

5 

E 

= 

5 

F 

= 

6 

F 

= 

6 

F 

= 

6 

F 

= 

6 

F 

= 

6 

F 

= 

6 

G 

= 

7 

G 

= 

7 

G 

= 

7 

G 

= 

7 

G 

= 

7 

G 

= 

7 

H 

= 

8 

H 

= 

8 

H 

= 

8 

H 

= 

8 

H 

= 

8 

H 

= 

8 

I 

= 

9 

I 

= 

9 

I 

= 

9 

I 

= 

9 

I 

= 

9 

I 

= 

9 

J 

= 

10 

J 

= 

10 

J 

= 

10 

J 

= 

10 

J 

= 

10 

J 

= 

10 

K 

= 

11 

K 

= 

11 

K 

= 

11 

K 

= 

11 

K 

= 

11 

K 

= 

11 

L 

= 

12 

L 

= 

12 

L 

= 

12 

L 

= 

12 

L 

= 

12 

L 

= 

12 

M 

= 

13 

M 

= 

13 

M 

= 

13 

M 

= 

13 

M 

= 

13 

M 

= 

13 

N 

= 

14 

N 

= 

14 

N 

= 

14 

N 

= 

14 

N 

= 

14 

N 

= 

14 

0 

= 

15 

0 

= 

15 

0 

= 

15 

0 

= 

15 

0 

= 

15 

0 

= 

15 

P 

= 

16 

P 

= 

16 

P 

= 

16 

P 

= 

16 

P 

= 

16 

P 

= 

16 

Q 

= 

17 

Q 

= 

17 

Q 

= 

17 

Q 

= 

17 

Q 

= 

17 

Q 

= 

17 

R 

= 

18 

R 

= 

18 

R 

= 

18 

R 

= 

18 

R 

= 

18 




S 

= 

19 

S 

= 

19 

S 

= 

19 

S 

= 

19 

S 

= 

19 




T 

= 

20 

T 

= 

20 

T 

= 

20 

T 

= 

20 







U 

= 

21 

U 

= 

21 

U 

= 

21 

U 

= 

21 







V 

= 

22 

V 

= 

22 

V 

= 

22 










W 

= 

23 

X 

= 

23 

X 

= 

23 










X 

= 

24 

Y 

= 

24 













Y 

= 

25 

Z 

= 

25 














Z = 26 


The three indicators thus become: 


No. 

1 - 

J 

Y 

B 

T 

M 

H 

= 10 

24 

2 20 13 

8 

No. 

2 - 

0 

E 

J 

I 

F 

E 

= 15 

5 

10 9 6 5 


No. 

3 - 

W 

L 

0 

L 

G 

D 

= 23 

12 

15 12 7 

4 


(2) We now multiply each number of the obtained numerical indicators 
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by a given "constant"* for each position of the indicator; and thereafter 
obtain the sum of the multiplications, as follows: 




Indicator 

■ No. 1 

10 

X 

89705175 

— 

897051750 

24 

X 

56787276 

= 

1362894624 

2 

X 

92587950 

= 

185175900 

20 

X 

82090450 

= 

1641809000 

13 

X 

42697200 

= 

555063600 

8 

X 

41755350 

= 

334042800 





4976037674 



Indicator No. 2 

15 

X 

89705175 

— 

1345577625 

5 

X 

56787276 

= 

283936380 

10 

X 

92587950 

= 

925879500 

9 

X 

82090450 

= 

738814050 

6 

X 

42697200 

= 

256183200 

5 

X 

41755350 

= 

208776750 


3759167505 




Indicator No 

. 3 

23 

X 

89705175 = 

2063219025 

12 

X 

56787276 = 

681447312 

15 

X 

92587950 = 

1388819250 

12 

X 

82090450 = 

985085400 

7 

X 

42697200 = 

298880400 

4 

X 

41755350 = 

167021400 


5584472787 


(3) The third and final step to obtain the desired successive 
numerical indicators is to divide the sums of the multiplications by 
26 X 25 X 23 X 21 X 19 X 17 = 101405850. The remainders of the the 
divisions will be the successive numerical indicators. Thus, the 
successive numerical indicators are found as follows: 


No. 1 

4976037674 

101405850 

49 

No. 2 

3759167505 

101405850 

37 

No. 3 

5584472787 

101405850 

55 


7151024. 

(No. 

1 = 7151024) 

7151055. 

(No. 

2 = 7151055) 

7151037. 

(No. 

3 = 7151037) 


*These "constants" apply to the Model Type C-48 HAGELIN CRYPTOGRAPH. A 
machine with wheels of other lengths will have a different set of 
"constants". Determining these "constants" is a problem within the theory 
of numbers , and involves solving simultaneous congruences. Chapter V 
of Recreations in the Theory of Numbers — The Queen of Mathematics 
Entertains, by Albert H. Beiler (Dover) presents a good elementary 
explanation of the problem. 
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There is an alternate method to obtain successive numerical 
indicators from unenciphered literal indicators. This method eliminates 
the cumbersome "multiplication step" and is an easier method from a 
manual viewpoint. The first step is to directly replace the letters of 
the literal indicator with the numbers shown below; and thereafter obtain 
the sum of the numbers. 




Wheel- 

■Length 



26 

25 

23 

21 

19 

17 

A=89705175 

A=56787276 

A=92587950 

A=82090450 

A=42697200 

A=41755350 

B=78004500 

B=12168702 

B=83770050 

B=62775050 

B=85394400 

B=83510700 

C=66303825 

0=68955978 

0=74952150 

0=43459650 

0=26685750 

0=23860200 

D=54603150 

D=24337404 

D=66134250 

0=24144250 

0=69382950 

0=65615550 

E=42902475 

E=81124680 

E=57316350 

E=04828850 

E=10674300 

E=05965050 

F=31201800 

F=36506106 

F=48498450 

F=86919300 

F=53371500 

F=47720400 

G=19501125 

0=93293382 

0=39680550 

0=67603900 

0=96068700 

0=89475750 

H=07800450 

H=48674808 

H=30862650 

H=48288500 

H=37360050 

H=29825250 

1=97505625 

1=04056234 

1=22044750 

1=28973100 

1=80057250 

1=71580600 

J=85804950 

J=60843510 

J=13226850 

J=09657700 

J=21348600 

J=11930100 

K=74104275 

K=16224936 

K=04408950 

K=91748150 

K=64045800 

K=53685450 

L=62403600 

L=73012212 

L=96996900 

L=72432750 

L=05337150 

L=95440800 

M=50702925 

M=28393638 

M=88179000 

M=53117350 

M=48034350 

M=35790300 

N=39002250 

N=85180914 

N=79361100 

N=33801950 

N=90731550 

N=77545650 

0=27301575 

0=40562340 

0=70543200 

0=14486550 

0=32022900 

0=17895150 

P=15600900 

P=97349616 

P=61725300 

P=96577000 

P=74720100 

P=59650500 

Q=03900225 

Q=52731042 

Q=52907400 

Q=77261600 

Q=16011450 

Q=00000000 

R=93605400 

R=08112468 

R=44089500 

R=57946200 

R=58708650 


8=81904725 

8=64899744 

8=35271600 

8=38630800 

8=00000000 


T=70204050 

T=20281170 

T=26453700 

T=19315400 



0=58503375 

0=77068446 

0=17635800 

0=00000000 



V=46802700 

V=32449872 

V=08817900 




W=35102025 

X=89237148 

X=00000000 




X=23401350 

¥=44618574 





¥=11700675 

Z=00000000 






Z=00000000 
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Indicator No. 1 


Indicator No. 2 


Indicator No. 3 


J = 85804950 

Y = 44618574 

B = 83770050 

T = 19315400 

M = 48034350 

H = 29825250 

311368574 


O = 27301575 

E = 81124680 

J = 13226850 

I = 28973100 

F = 53371500 

E = 05965050 

209962755 


W = 35102025 

L = 73012212 

0 = 70543200 

L = 72432750 

G = 96068700 

D = 65615550 

412774437 


The final step to arrive at the successive numerical indicator is to 
subtract from the "sum of the numbers" — but only if the sum is greater 
than 101405850 — a multiple of 101405850, such that the resulting 
difference will be less than 101405850. The resulting difference (or 
sum, if no subtraction is made) is the successive numerical indicator. 

Thus, one of the following five multiples of 101405850 will be 
subtracted from a "sum" to result in a difference of less than 101405850: 

101405850 

202811700 

304217550 

405623400 

507029250 


In the case of our three given indicators, the successive numerical 
indicators are found as follows: 


Indicator No. 1 

311368574 

- 304217550 

7151024 


Indicator No. 2 

209962755 

- 202811700 

7151055 


Indicator No. 3 

412774437 

-405623400 

7151037 


From the fact that the successive niamerical indicators are so close 
together, we can immediately tell that we are fortunate to have what is 
termed an "overlap" between messages. An "overlap" exists when two 
messages have been enciphered with the same generated key. Indeed, in 
the present case we have three messages "overlapping"! 

Since we know from the successive numerical indicators exactly where 
each message has been enciphered along the total generated key running 
from position 1 to position 101405850, we may prepare a worksheet with 
the messages "in depth"; and knowing that each message begins with the 
word "MESSAGE" will enable us to "strip off" some generated key as follows 
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Position: 
Key: 
No. 1: 


24 25 26 27 28 29 30 

13 13 15 1* 0* 1* 21 

A I W I Z U Q 

message 


31 32 33 34 35 36 37 

8 _ 

I Y Q E W A R 
z z 


38 39 40 41 42 43 44 

ii ^ 

N S A U Y Q D 

e r o z s t o 


No. 3 : E N R W T K F 
message 


S 

z 


45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 

__1__1111111_2^244_ 

ULJMVOHBLHKRMILWGZWFCVFQ 

t z yet z r_e 


No. 2 : RMSUEPTEG 
message z 


B N R Q X 


QD FWQGXDVZLXWXFNKE 

stop z i_n z 


H F V F L U 


69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 


FOTGKFOYGRPMZIZMJWZTWIBC 


QRPAYUGYAFRYJEMMMUAFMXTI 


LCIVYPOMXAFRJYRMVJNFXEKT 


*In the generated key a 0 might also be 26; and 1 might be 27. 
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93 94 95 96 97 98 99 00 01 02 03 04 05 06 07 08 09 10 11 12 13 14 15 16 


LFXXES MVSSAHFXXPBJDHRAJ B 


MQPWPHWPKJXJFLHFDJRXPTJE 


KKOCWBYGNJUHFEHDBEWMSOUW 


17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 


Q P. 


ZGSRCGWK. 


WPCDGSRDWLAZEAA. 


It is evident that the messages are correctly aligned "in depth"; and 
that the portions of generated key so far recovered or "stripped off" are 
correct. With three messages in depth the problem of recovering key is 
not particularly difficult. As a last resort, the trial-and-error method 
of sliding probable words along a message, one letter at a time, until 
confirmation of the "correctness" of the word is obtained by the text in 
another message may be tried. With only two messages "in depth" the 
problem is more difficult, but still generally solvable in time. 

In the case of the present three messages, it appears that in Message 
No. 3 numbers will occur in positions 45 through 54; numbers also will 
follow the word "MESSAGE" in Message No. 2. 

The student may try his own hand at reading the above messages. 

For our part, we shall attempt now to recover the pin and lug settings, 
given the recovered key as follows: 
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1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

13 

13 

15 

1* 

0* 

1* 

21 

8 

- 

- 

- 

- 

0* 

17 

18 

10 

15 

20 

17 

10 

18 

10 

11 

23 

1* 

26 

27 

28 

29 

30 

31 

32 

33 

34 

35 

36 

37 

38 

39 

40 

41 

42 

43 

44 

45 

46 

47 

48 

49 

50 

21 

6 

12 

17 

0* 

25 

4 

17 

11 

13 

5 

22 

24 

4 

25 

10 

11 

17 

10 

20 

5 

17 

8 

20 

13 

51 

52 

53 

54 

55 

56 

57 

58 

59 

60 

61 

62 

63 

64 

65 

66 

67 

68 

69 

70 

71 

72 

73 

74 

75 

10 

6 

12 

15 

5 

22 

12 

14 

17 

11 

12 

13 

14 

20 

6 

15 

8 

19 

7 

17 

10 

15 

15 

9 

22 

76 

77 

78 

79 

80 

81 

82 

83 

84 

85 

86 

87 

88 

89 

90 

91 

92 

93 

94 

95 

96 

97 

98 

99 

100 

12 

15 

7 

18 

9 

21 

5 

22 

12 

10 

19 

9 

16 

12 

10 

19 

10 

8 

21 

15 

11 

22 

6 

6 

22 


101 102 103 104 105 106 107 108 
10 23 5 9 21 9 0* 0* 

Let us begin by identifying the wheel or wheels which contain the 
larger number of lugs. We shall take each wheel length in turn, beginning 
with Wheel Length 17. We write the recovered key horizontally with a 
"period" of 17 to produce 17 columns — 

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 

13 13 15 1* 0* 1* 21 8 - - - - 0* 17 18 10 15 

20 17 10 18 10 11 23 1* 21 6 12 17 0* 25 4 17 11 

13 5 22 24 4 25 10 11 17 10 20 5 17 8 20 13 10 

6 12 15 5 22 12 14 17 11 12 13 14 20 6 15 8 19 

7 17 10 15 15 9 22 12 15 7 18 9 21 5 22 12 10 

19 9 16 12 10 19 10 8 21 15 11 22 6 6 22 10 23 

5 9 21 9 0* 0* 


Column 14 is noted. If Wheel Length 17 contains, for example, seven 
lugs, which we can consider as a "larger number of lugs", with a total 
of 25 in the column, the pin of Wheel Length 17 must surely be effective, 
yet there is also a total of 5 within the same column — which indicates 
that there cannot be more than five lugs on Wheel Length 17! Therefore, 
Column 14 indicates that Wheel Length 17 in all likelihood does not 
contain more than five lugs. We continue with Wheel Length 19 — 

I 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 

13 13 15 1* 0* 1* 21 8 - - - - 0* 17 18 10 15 20 17 

10 18 10 11 23 1* 21 6 12 17 0* 25 4 17 11 13 5 22 24 

4 25 10 11 17 10 20 5 17 8 20 13 10 6 12 15 5 22 12 

14 17 11 12 13 14 20 6 15 8 19 7 17 10 15 15 9 22 12 

15 7 18 9 21 5 22 12 10 19 9 16 12 10 19 10 8 21 15 

II 22 6 6 22 10 23 5 9 21 9 0* 0* 

From columns 2 and 12 it appears that Wheel Length 19 might well have 
seven lugs I In any case. Wheel Length 19 cannot have more than seven 
lugs, though it might have six or five. 

As it appears likely that Wheel Length 19 does contain seven lugs. 
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let us identify where possible those columns where the pins are effective 
or non-effective. Thus, any column containing a total less than 7 must 
be non-effective; and it is very likely that any column containing a 
total of 22 or more will be effective. Note that the total of 22 could 
arise with a non-effective wheel containing seven lugs only if the seven 
lugs contained an "overlap" of two or more lugs with one or more other 
wheels. Indicating effective columns with a plus sign (+) and non- 
effective columns with a minus sign (-), identifications are as follows: 

- + + - + - - + + 

I 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 

13 13 15 1* 0* 1* 21 8 - - - - 0* 17 18 10 15 20 17 

10 18 10 11 23 1* 21 6 12 17 0* 25 4 17 11 13 5 22 24 

4 25 10 11 17 10 20 5 17 8 20 13 10 6 12 15 5 22 12 

14 17 11 12 13 14 20 6 15 8 19 7 17 10 15 15 9 22 12 

15 7 18 9 21 5 22 12 10 19 9 16 12 10 19 10 8 21 15 

II 22 6 6 22 10 23 5 9 21 9 0* 0* 

It may be noted, also, that with a column identified as to 
"effectiveness", the ambiguous totals, 0/26 and 1/27 (0* and 1*), will 
be resolved. Thus, in a non-effective column 0* will be 0 and 1* will 
be 1; and in an effective column 0* will be 26 and 1* will become 27. 

The above columns with most of the ambiguous totals resolved will then 
appear as follows: 

- + - +-- - + + 

I 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 

13 13 15 1 26 1 21 8 - - - - 0 17 18 10 15 20 17 

10 18 10 11 23 1 21 6 12 17 0* 25 4 17 11 13 5 22 24 

4 25 10 11 17 10 20 5 17 8 20 13 10 6 12 15 5 22 12 

14 17 11 12 13 14 20 6 15 8 19 7 17 10 15 15 9 22 12 

15 7 18 9 21 5 22 12 10 19 9 16 12 10 19 10 8 21 15 

II 22 6 6 22 10 23 5 9 21 9 26 0 

In similar fashion we can continue with Wheel Length 21, except that 
this time we can use the "resolved" totals above — 


1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

13 

13 

15 

1 

26 

1 

21 

8 

- 

- 

- 

- 

0 

17 

18 

10 

15 

20 

17 

10 

18 

10 

11 

23 

1 

21 

6 

12 

17 

0* 

25 

4 

17 

11 

13 

5 

22 

24 

4 

25 

10 

11 

17 

10 

20 

5 

17 

8 

20 

13 

10 

6 

12 

15 

5 

22 

12 

14 

17 

11 

12 

13 

14 

20 

6 

15 

8 

19 

7 

17 

10 

15 

15 

9 

22 

12 

15 

7 

18 

9 

21 

5 

22 

12 

10 

19 

9 

16 

12 

10 

19 

10 

8 

21 

15 

11 

22 

6 

6 

22 

10 

23 

5 

9 

21 


9 26 0 

Column 19 indicates that Wheel Length 21 has no more than five lugs. 
Let us continue the same procedure with Wheel Length 23 — 
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1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 


13 13 15 1 26 1 

23 1 21 6 12 17 
17 8 20 13 10 6 
17 10 15 15 9 22 

8 21 15 11 22 6 


21 8 - - - 
0* 25 4 17 11 

12 15 5 22 12 

12 15 7 18 9 

6 22 10 23 5 


- 0 17 18 10 15 

13 5 22 24 4 25 

14 17 11 12 13 14 

21 5 22 12 10 19 

9 21 9 26 0 


20 17 10 18 10 11 
10 11 17 10 20 5 
20 6 15 8 19 7 
9 16 12 10 19 10 


From these columns it appears that Wheel Length 23 might have eight 
lugs I Note especially columns 1 and 8. Just as we did with Wheel Length 
19, let us identify where possible the effective and non-effective 
columns, using the criteria that a column containing a total less than 
7 must be non-effective, and a column containing a total of 22 or more 
will be effective. The results are as follows: 

+ - + - + - _ + + 

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 

13 13 15 1 26 1 21 8 - - - - 0 17 18 10 15 20 17 10 18 10 11 

23 1 21 6 12 17 0* 25 4 17 11 13 5 22 24 4 25 10 11 17 10 20 5 

17 8 20 13 10 6 12 15 5 22 12 14 17 11 12 13 14 20 6 15 8 19 7 

17 10 15 15 9 22 12 15 7 18 9 21 5 22 12 10 19 9 16 12 10 19 10 

8 21 15 11 22 6 6 22 10 23 5 9 21 9 26 0 

The ambiguous 0* in column 7 becomes resolved as 0 since the pin in 
column 7 is non-effective. We continue with Wheel Length 25: 

1 2 3 4 5 67 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 

13 13 15 1 26 1 21 8 - - - - 0 17 18 10 15 20 17 10 18 10 11 23 1 

21 6 12 17 0 25 4 17 11 13 5 22 24 4 25 10 11 17 10 20 5 17 8 20 13 

10 6 12 15 5 22 12 14 17 11 12 13 14 20 6 15 8 19 7 17 10 15 15 9 22 

12 15 7 18 9 21 5 22 12 10 19 9 16 12 10 19 10 8 21 15 11 22 6 6 22 

10 23 5 9 21 9 26 0 

From columns 5 and 6 it appears that Wheel Length 25 contains one lug I 
We continue with the final wheel. Wheel Length 26: 

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 

13 13 15 1 26 1 21 8 - - - - 0 17 18 10 15 20 17 10 18 10 11 23 1 21 

6 12 17 0 25 4 17 11 13 5 22 24 4 25 10 11 17 10 20 5 17 8 10 13 10 6 

12 15 5 22 12 14 17 11 12 13 14 20 6 15 8 19 7 17 10 15 15 9 22 12 15 7 

18 9 21 5 22 12 10 19 9 16 12 10 19 10 8 21 15 11 22 6 6 22 10 23 5 9 

21 9 26 0 

Column 3 indicates that the number of lugs of Wheel Length 26 is not over 
five. 

Results of our analysis to this point are: 

(1) Wheel Length 17 does not contain more than five lugs. 

(2) It is likely that Wheel Length 19 contains seven lugs; and 14 of 

19 pins have been identified (as to their effectiveness). 

(3) Wheel Length 21 does not contain more than five lugs. 
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(4) Wheel Length 23 probably has eight lugs; and 17 of the 23 pins 
have been identified (as to their effectiveness). 

(5) Wheel Length 25 has been found to contain one lug, 

(6) Wheel Length 26 contains not more than five lugs. 

(7) Ambiguous totals 0/26 and 1/27 (0* and 1*) have been resolved. 

Just as we did in Chapters 4 and 5, let us now '*lay out" in a distinct 
"form" the so-far recovered key. At the same time we shall bring the 
"form" up-to-this-point with: 

(1) the so-far recovered pin-settings of Wheel Lengths 19 and 23. 

(2) the assumption that Wheel Length 19 contains seven lugs, Wheel 
Length 23 eight lugs, and Wheel Length 25 one lug. 

(3) the pins of all wheels contributing to a key total of 0 to be 
appropriately indicated as non-effective. 

(4) the pins of all wheels contributing to a key total of 1 to be 
indicated as non-effective, except for the pin of Wheel Length 25 which 
will be indicated as effective. 

The "foinn" thus appears as follows: 


Recovered key: 

13 

13 

15 

1 

26 

1 

21 

8 

- 

- 

- 

- 

0 

17 

18 

10 

15 

20 

17 




(17: 




0 


0 


0 





0 




1 

1 

1 




(19: 

0 

7 

0 

0 

7 

0 

7 

0 



0 

7 

0 

0 



0 

7 

7| 

Wheel 

(21: 



0 

0 


0 



0 




0 







Length 

(23: 

8 

0 


0 

8 

0 

0 

8 

0 

8 

0 


0 

8 

8 

0 

8 


0 




(25: 




1 

0 

1 


0 





0 










(26: 




0 


0 







0 











1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

10 

18 

10 

11 23 

1 

21 

6 

12 

17 

0 

25 

4 

17 

11 

13 

5 

22 

24 

4 

25 

10 

11 

17 


0 


0 

0 





0 





1 “ 



0 


0 


0 


0 

7 

0 

0 7 

0 

7 

0 



0 

7 

0 

0 



0 

7 

7 10 

7 

0 

0 

7 


1 

1 

0 

0 


0 



0 




0 









r 




0 |8 

0 


0 

8 

0 

0 

8 

0 

8 

0 


0 

8 

8 

0 

8 


0 






1 

1 , 



1 

0 

1 


0 





0 










0 

1 

1 



0 


0 







0 





20 

21 

22 

23 24 

25 

26 

27 

28 

29 

30 

31 

32 

33 

34 

35 

36 

37 

38 

39 

40 

41 

42 

43 

10 

20 

5 

17 8 

10 

13 

10 

6 

12 

15 

5 

22 

12 

14 

17 

11 

12 

13 

14 

20 

6 

15 

8 




0 



1 

1 



0 


0 


0 





0 




0 

7 

0 


0 

7 

0 

0 



0 

7 


\0 

7 

0 

0 

7 

0 

7 

0 




0 

0 

0 



0 




0 









n 


0 

0 



iJ 

CO 


0 

8 

0 

0 

8 

0 

8 

0 


0 

8 

8 

0 

8 


0 








1 1 

1 



1 

0 

1 


0 





0 











0 

1 

1 



0 


0 







0 



44 

45 

46 

00 

49 

50 

51 

52 

53 

54 

55 

56 

57 

58 

59 

60 

61 

62 

63 

64 

65 

66 

67 


76 
























68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 


10 

8 

21 

15 

11 

22 

6 

6 

22 

10 

23 

5 

9 

21 

9 

26 

0 


0 





0 




1 

1 



0 


0 


0 

7 

7 1 

0 

7 

0 

0 

7 

0 

7 

0 



0 

7 

0 


0 




0 








1 

1 


0 


8 

0 


0 

8 

0 

0 

8 

0 

8 

0 


0 

8 

8 

0 









1 1 

1 



1 

0 

1 


0 












0 


1 



0 

92 

93 

94 

95 

96 

97 

98 

99 

00 

01 

02 

03 

04 

05 

06 

07 

08 


100 


From here the "completion" of the "form" and recovery of the pin and 
lug settings appears inevitable. For example^ non-effective pins are evident 
in Position 8. With the total 8 already derived from Wheel Length 23, unless 
there is a complete "overlap" of lugs on another wheel (unlikely), other pins 
in the same position will be non-effective. Numerous other non-effective 
pins can be seen in Positions 69, 78, 93, and 106. With the addition of 
these non-effective pins to the "form" as a whole, final solution appears 
close. It ia left to the student to complete the "form"; he should have 
no difficulty. 

In this chapter the student has found that one of the HAGELIN CRYPTOGRAPH'S 
vulnerable points is the possibility of an "overlap" between two or more 
messages — enabling the cryptanalyst to recover key from the messages "in 
depth" and from this key to recover the original pin and lug settings. 

In the next chapter we shall discuss a means other than by using 
unenciphered indicators to put messages "in depth"; and we shall discuss 
a more general mathematical approach to solving the HAGELIN CRYPTOGRAPH. 

PROBLEMS 


56. 


Probable words: " 
No. 1 - E H U M B 
H X C V J 
M S T B S 


ENEMY", "REQUEST", "SITUATION", "ARTILLERY". 


F J J I J 
K N T M G 
V X B H S 
T L N Q I 


U M G L J 
T W G L W 
I H X B X 


R A K Y H 
E S S V D 


P K X Y R 


Y J J H G 
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V F W W Y 


D G L V D 
E F Q G S 


H C M N I 
K F Q W J 
B V Q L U. 

















• No. 2 


No. 2 - 

L 

H 

G 

F 

Q 

A 

J 

J 

G 

E 

U 

H 

I 

L 

H 

A 

0 

I 

Z 

Q 

T 

Z 

J 

M 

B 


X 

S 

Y 

V 

Y 

B 

0 

I 

L 

S 

L 

A 

A 

0 

K 

B 

C 

V 

s 

Y 

W 

E 

Y 

T 

E 


P 

U 

I 

Y 

F 

M 

H 

D 

T 

E 

S 

R 

D 

E 

G 

L 

H 

L 

0 

Y 

L 

Q 

L 

V 

D 


0 

R 

I 

S 

I 

G 

L 

Q 

Q 

F. 
















No. 3 - 

0 

K 

J 

I 

S 

C 

J 

J 

E 

E 

N 

L 

K 

Y 

K 

Z 

L 

M 

M 

K 

F 

Y 

R 

P 

C 


R 

P 

M 

B 

C 

X 

I 

X 

S 

D 

0 

J 

R 

R 

W 

Y 

D 

Q 

Y 

L 

Y 

X 

D 

N 

V 


R 

N 

J 

R 

u 

B 

L 

K 

V 

C 

C 

B 

G 

I 

Q. 











No. 4 - 

B 

F 

U 

0 

F 

L 

J 

J 

H 

J 

M 

M 

V 

L 

G 

Z 

S 

K 

M 

S 

U 

T 

Q 

L 

I 


I 

C 

Y 

0 

H 

N 

V 

I 

I 

U 

Z 

R 

D 

Y 

U 

B 

C 

H 

I 

U 

V 

L 

K 

X 

D 


E 

R 

Y 

H 

R 

Y 

S 

G 

W 

I 

Q 

R 

0 

R 

R 

0 

R 

T 

E 

W 

R 

J 

N 

K 

Q 


0 

L 

W 

Z 

0 

T 

T 

Q 

I 

Z 

w 

D 

S 

I 

W. 











No. 5 - 

I 

M 

E 

A 

M 

B 

J 

J 

c 

E 

B 

Q 

G 

P 

0 

I 

A 

K 

T 

T 

F 

H 

Z 

E 

N 


T 

X 

K 

U 

0 

B 

H 

u 

H 

M 

H 

A 

F 

E 

R 

S 

L 

I 

R 

Z. 






No. 6 - 

W 

B 

S 

0 

H 

P 

J 

J 

F 

E 

V 

F 

D 

M 

H 

c 

V 

G 

E 

Y 

Q 

I 

I 

F 

U 


Y 

K 

X 

V 

K 

F 

H 

T 

Q 

H 

R 

S 

C 

I 

J 

Q 

Z 

F 

I 

S 

J 

L 

L 

Q 

H 


P 

L 

V 

W 

W 

U 

L 

T 

s 

U 

U 

F 

V 

V 

E 

A 

E 

T 

P 

M 

W 

P 

S 

M 

B. 

No. 7 - 

L 

L 

S 

E 

G 

C 

J 

J 

F 

J 

V 

S 

W 

P 

W 

S 

E 

B 

0 

K 

B 

R 

K 

0 

P 


E 

M 

D 

S 

W 

Q 

P 

I 

Y 

X 

A 

G 

X 

K 

X 

N 

T 

K 

A 

R 

Y 

C 

T 

T 

M 


N 

H 

M 

C 

S 

A 

T 

K 

L 

E 

T 

S 

G 

P 

L 

D 

P 

L 

G 

P. 






No. 8 - 

M 

P 

F 

U 

J 

N 

J 

J 

E 

J 

N 

A 

V 

X 

A 

C 

S 

N 

H 

X 

V 

V 

Y 

R 

L 


V 

Y 

W 

V 

K 

M 

D 

J 

B 

H 

T 

F 

I 

P 

Z 

I 

T 

A 

T 

F 

Y 

J 

A 

S 

T 


U 

U 

W 

H 

M 

W 

W 

L 

X. 

J. 
















No. 9 - 

w 

R 

P 

N 

H 

E 

J 

J 

E 

J 

I 

C 

B 

I 

M 

V 

B 

L 

V 

J 

R 

Y 

E 

T 

Y 


c 

D 

P 

I 

Z 

U 

V 

F 

K 

M 

Q J 

F 

J 

D 

T 

X 

Z 

D 

M 

Y 

U 

A 

Q 

C 


u 

H 

T 

D 

R 

B 

J 

L 

R 

T 
















No. 10- 

F 

D 

G 

J 

F 

M 

J 

J 

E 

E 

A 

T 

T 

N 

S 

N 

E 

E 

W 

M 

N 

V 

D 

U 

Z 


X 

U 

Y 

I 

A 

F 

R 

N 

Q 

X 

B 

T 

Q 

N 

M 

Y 

I 

S 

A 

B 

Q 

B 

G 

T 

Q 


H 

C 

C 

K 

M 

R 

J 

Q 

L 

Y 

Q 

P 

B 

L 

R. 
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57. The following four messages have the same streotype beginning 


No. 1 - I X C 
UFO 
M E R 


K P C J J F 
C T X R G K 
T G K Q D Q 


E U S N G 
Y O F V L 
J D T A I 


E S J I N 
T V X A A 
G S Z L N 


X H I W M I 
W C W S D Z 
E Y S G I O 


No. 2 - S H M U G 
B F V M A 
Y A J N R 


MJJEE NAF 
ZXJRA COF 
FYJOZ TWB 


H F Z A X F D 
G H H R G G P 
I O 


G D C I F 
R P D N U 


No. 3 - A 0 R C H 
H O G G B 


L J J H J 
C J Y N P 


X U M F E 
X B T X V 


JZAKT AGTIN 
VTLON CIGIX 


U V P R P 
V Y U I K 


V M I N V 
Q R H C A 
D Z N N X 


N G A E M 
X L E S P 
W E B S E 


No. 4 - S F G K L 
S J D D G 
B L W N N 


L J J F E 
C I E O 0 
H R R B A 


J W L D K 
P B U J J 
H E T K N 


Q G P H B 
H T E Z Z 
N Y N X 0 


I G A N E 
K M T O T 
0 X X R L 
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Chapter 8 


ANALYSIS OF THE SIX-WHEEL HAGELIN CRYPTOGRAPH 
GIVEN A SPECIAL SITUATION 


When employing any cryptographic system it is difficulty if not 
impossible, for correspondents never to make a mistake. Reasons are 
many: an inexperienced, untrained individual suddenly finds himself 

performing complicated cryptographic operations; an experienced, well- 
trained "cryptographic clerk" suddenly has a lapse of memory and 
a small error is made; or a situation arises, for example, where a 
message is enciphered and transmitted by one clerk, and shortly 
thereafter another clerk transmits the same message a second time. 


Consider the following two HAGELIN CRYPTOGRAPH messages which have 
been transmitted within an hour of each other: 


No. 1 


B G K T D W 
K B U E C J 
A F Z W U J 
B S C G V S 
W E W X Q V 


Z V N P MR 
J I P R P V 
R G A W F 0 
E G R K A J 
D W W H V Q 


E V W W W R M 
T K P U T T I 
M B J B X Q S 
B Y M E Q H G 
V G U U W V V 


G T U K R G 
U N F G N U 
F I W V D W 
L U H P Y B 
N L 0 A U A 


D W N H Y 


Q V V T V 


J Y L S T 


XINVK FPKTK 


T M L G Z 


L D A B W. 


No. 2 


B G K T D 


W Z V N P 


M R E G F 


W T X K T 


L 0 H I F 


J V O B F 


V V Q V K 


X D E E G 


R I R N G 


W F H R L 


V N Q T Z 


V Y R U X 


T N U U P 


G M A T B 


S L G X X 


PDLMW CYJJH 
VUSMF WNQRZ 


OLBKZ OURHH 
CVMLT HKUNE 


T B W X G 
D V Z W J 


W M K V Z 


L U X Q N 


S N M W U 


R T H- U H 


N C A H P 


A Q L H I 


X C U B W. 


The cryptanalyst quickly notes that the first 13 letters and last two 
letters of the messages are similar; and that the lengths of the two 
messages are the same. The conclusion: the internal plaintext of the 
messages is the same; and the generated key of the HAGELIN CRYPTOGRAPH could 
well be the same. 


80 


From the point where the two messages differ the next 20 letters may 
be put "in depth" as follows: 


Position: 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

29 

30 

31 

32 

33 

Key: 
No. 1: 

V 

w 

W 

W 

R 

M 

G 

T 

U 

K 

R 

G 

K 

B 

U 

E 

C 

J 

J 

I 

No. 2: 

G 

F 

W 

T 

X 

K 

T 

L 

0 

H 

I 

F 

J 

V 

0 

B 

F 

V 

V 

Q 


We would like "to hope" that the key of both messages is the same; and 
that, therefore, the messages are correctly "in depth". At the same time, 
we can also "hope" that the plaintext of both messages is the same, except 
that at Position 14 (where the ciphertext differs) either a letter was 
added or deleted from one of the messages. 

If at this point we assume the key in Position 14 to be 0, the resulting 
plaintext letters will be: 


Position: 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

29 

30 

31 

32 

33 

Key: 

0 




















No. 1: 

V 

e 

W 

W 

W 

R 

M 

G 

T 

U 

K 

R 

G 

K 

B 

U 

E 

C 

J 

J 

I 

No. 2: 

G 

F 

w 

T 

X 

K 

T 

L 

0 

H 

I 

F 

J 

V 

0 

B 

F 

V 

V 

Q 


t 


From this point with respect to the plaintext of the messages there are 
two possibilities: 

(1) The plaintext of Message No. 1 from Position 14 is the same as 
that of Message No. 2 from Position 15 on, or 

(2) The plaintext of Message No. 2 from Position 14 is the same as 
that of Message No. 1 from Position 15 on. 

Considering the first possibility, plaintext of both messages will be 
as follows: 


Position: 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

29 

30 

31 

32 

33 

key: 

0 

10 

10 

7 

8 

1 

8 

13 

8 

21 

19 

7 

10 

21 

8 

15 

16 

9 

21 

2 

No. 1: 

V 

W 

W 

W 

R 

M 

G 

T 

U 

K 

R 

G 

K 

B 

U 

E 

C 

J 

J 

I 


e 

n 

n 

k 

q 

o 

b 

t 

n 

k 

b 

a 

z 

t 

n 

k 

n 

z 

1 

t 

No. 2: 

G 

F 

W 

T 

X 

K 

T 

L 

0 

H 

I 

F 

J 

V 

0 

B 

F 

V 

V 

Q 


t 

e 

n 

n 

k 

q 

o 

b 

t 

n 

k 

b 

a 

z 

t 

n 

k 

n 

z 

1 


If we consider the second possibility, plaintext of the two messages 
will be: 
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Position: 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

29 

30 

31 

32 

33 

key: 

0 

16 

7 

7 

5 

20 

16 

16 

25 

21 

5 

3 

8 

0 

25 

15 

16 

o 

CM 

8 

21 

No. 1: 

V 

W 

W 

W 

R 

M 

G 

T 

U 

K 

R 

G 

K 

B 

U 

E 

C 

J 

J 

I 


e 

t 

k 

k 

n 

h 

j 

w 

e 

k 

n 

w 

X 

y 

e 

k 

n 

k 

y 

m 

No. 2: 

G 

F 

W 

T 

X 

K 

T 

L 

0 

H 

I 

F 

J 

V 

0 

B 

F 

V 

V 

Q 


t 

k 

k 

n 

h 

j 

w 

e 

k 

n 

w 

X 

y 

e 

k 

n 

k 

y 

m 

e 


It is evident that the so-called plaintext of both possibilities is 
incorrect. The text obtained from both possibilities has resulted from 
the initial assumption that the key in Position 14 is 0. The key actually 
might have been any number from 0 to 25; and from each key different 
plaintext would have resulted 

We could individually try in succession each key and look for meaningful 
plaintext; but an easier, more mechanical method would be "to run down the 
alphabet" starting with the incorrect plaintext obtained in the two 
possibilities above, and to then look for meaningful plaintext on one of the 
generatrices obtained. 

Negative results are obtained by "running down the alphabet" starting 
with the incorrect plaintext of the first possibility, as follows: 


t 

e 

n 

n 

k 

q 

o 

b 

t 

n 

k 

b 

a 

z 

t 

n 

k 

n 

z 

1 

u 

f 

o 

o 

1 

r 

P 

c 

u 

o 

1 

c 

b 

a 

u 

o 

1 

o 

a 

m 

V 

g 

P 

P 

m 

s 

q 

d 

V 

P 

m 

d 

c 

b 

V 

P 

m 

P 

b 

n 

w 

h 

q 

q 

n 

t 

r 

e 

w 

q 

n 

e 

d 

c 

w 

q 

n 

q 

c 

o 

X 

i 

r 

r 

o 

u 

s 

f 

X 

r 

o 

f 

e 

d 

X 

r 

o 

r 

d 

P 

y 

j 

s 

s 

P 

V 

t 

g 

y 

s 

P 

g 

f 

e 

y 

s 

P 

s 

e 

q 

z 

k 

t 

t 

q 

w 

u 

h 

z 

t 

q 

h 

g 

f 

z 

t 

q 

t 

f 

r 

a 

1 

u 

u 

r 

X 

V 

i 

a 

u 

r 

i 

h 

g 

a 

u 

r 

u 

g 

s 

b 

m 

V 

V 

s 

y 

w 

j 

b 

V 

s 

j 

i 

h 

b 

V 

s 

V 

h 

t 

c 

n 

w 

w 

t 

z 

X 

k 

c 

w 

t 

k 

j 

i 

c 

w 

t 

w 

i 

u 

d 

o 

X 

X 

u 

a 

y 

1 

d 

X 

u 

1 

k 

j 

d 

X 

u 

X 

j 

V 

e 

P 

y 

y 

V 

b 

z 

m 

e 

y 

V 

m 

1 

k 

e 

y 

V 

y 

k 

w 

f 

q 

z 

z 

w 

c 

a 

n 

f 

z 

w 

n 

m 

1 

f 

z 

w 

z 

1 

X 

g 

r 

a 

a 

X 

d 

b 

o 

g 

a 

X 

o 

n 

m 

g 

a 

X 

a 

m 

y 

h 

s 

b 

b 

y 

e 

c 

P 

h 

b 

y 

P 

o 

n 

h 

b 

y 

b 

n 

z 

i 

t 

c 

c 

z 

f 

d 

q 

i 

c 

z 

q 

P 

o 

i 

c 

z 

c 

o 

a 

j 

u 

d 

d 

a 

g 

e 

r 

j 

d 

a 

r 

q 

P 

j 

d 

a 

d 

P 

b 

k 

V 

e 

e 

b 

h 

f 

s 

k 

e 

b 

s 

r 

q 

k 

e 

b 

e 

q 

c 

1 

w 

f 

f 

c 

i 

g 

t 

1 

f 

c 

t 

s 

r 

1 

f 

c 

f 

r 

d 

m 

X 

g 

g 

d 

j 

h 

u 

m 

g 

d 

u 

t 

s 

m 

g 

d 

g 

s 

e 

n 

y 

h 

h 

e 

k 

i 

V 

n 

h 

e 

V 

u 

t 

n 

h 

e 

h 

t 

f 

o 

z 

i 

i 

f 

1 

j 

w 

o 

i 

f 

w 

V 

u 

o 

i 

f 

i 

u 

g 

P 

a 

j 

j 

g 

m 

k 

X 

P 

j 

g 

X 

w 

V 

P 

j 

g 

j 

V 

h 

q 

b 

k 

k 

h 

n 

1 

y 

q 

k 

h 

y 

X 

w 

q 

k 

h 

k 

w 

i 

r 

c 

1 

1 

i 

o 

m 

z 

r 

1 

i 

z 

y 

X 

r 

1 

i 

1 

X 

j 

s 

d 

m 

m 

j 

P 

n 

a 

s 

m 

j 

a 

z 

y 

s 

m 

j 

m 

y 

k 


Meaningful plaintext is found on none of the generatrices. Let us turn. 
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therefore, to the incorrect plaintext obtained from the second possibility 
above. Again, let us "run down the alphabet" and this time we find success 
On one of the generatrices we find real plaintext as follows: 
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1 


Thus, in the second possibility, above, with the correct plaintext now 
identified, the recovered key and messages "in depth" appear as follows: 


Position: 14 15 16 17 18 19 20 21 
Key: 21 11 2 2 0* 15 11 11 
No. 1:VWWWRMGT 
z officer 

No. 2:GFWTXKTL 
officerz 


22 23 24 25 26 27 28 29 30 31 32 33 
20 16 0* 24 3 21 20 10 11 15 3 16 
UKRGKBUECJ JI 
z first z fifth 

OHIFJVOBFVVQ 

firstzfifthz 


It is now apparent why the two ciphertext messages are not the same. 

In Message No. 2 the letter "z", as a word-spacer, was omitted in Position 
14. 

From this point the problem of recovering the key for the remaining 
letters of the messages is purely a mechanical process; and with 
sufficient key recovered, the problem of reconstructing the pin-settings 
for the various wheels, and establishing the number of lugs on each 
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wheel is very straightforward following the method described in Chapter 7. 

The completion of the present problem is therefore left to the student. 

The cryptanalyst must always be alert to detect the situation just 
covered, a message being enciphered twice with the same wheel-settings. 

In the case of a message of any length, it would be very difficult to 
encipher the same message twice and to have the resulting ciphertexts be 
absolutely similar. There is always the great probability that a letter 
here and there will be dropped, added, etc., such that for the cryptanalyst 
such duplicate messages can only be described as "great finds"! Even an 
experienced "cryptographic clerk" may often be under the mistaken belief 
that re-enciphering the same text twice with the same wheel-settings is 
not a blunder, for he thinks erroneously that the ciphertext will be the 
same. 


The motto, then, for the cryptanalyst is to be alert to detect anything 
unusual, out of the ordinary; and especially, to look for the case of a 
message being enciphered twice! 


PROBLEMS 


58. The following two messages have been intercepted within minutes of 
each other: 


No. 1 - V I J 
P D I 
G B M 
F P N 

Y I Z 

V J G 


NO 0 J A B J 
PR L T E J Y 
W J P L O V B 
W M K P Q S A 
IS C S U T Z 
J Y 


UCAOA GFH 
JKPSB AVW 
SAASG BRA 
CDRUO HIR 
KXNTJ JDM 


Y B X 0 I S M 
GY T K D B Q 

Y J T Z B V S 
Z I I G D H R 
C H F L C H L 


No. 2-VIJNO OJAAE UCAOA GFHYB XOISM 


P D I P R 


L T E J Y 


JKPSB AVWGY 


G B M W J 
J V S L L 
J V Q P D 


P L 0 V B 
R P J Q S 
W T I P Y 


M R X H E 
N C Y O K 
D P G U A 


G I Q R T 
K M A N S 
E X R R C 


T K D B Q 
U F R J T 
D H X S Q 
E L D J U 
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59. Plaintext of the following three messages is believed to be the 


same. 


First word is likely to be 


"RESISTANCE". 


No. 1 


R Q X A R 
B N I Q R 
T M M X S 
E D D Y L 
W I A V A 


C J A J E 
Z T 0 E 0 
R R E K L 
J Q I L Q 
Q J U J Q 


H E A A M 
S B S U U 
F C B I Z 
S O R B X 
G F M I K, 


U S Q P H 
A U Y R H 
S S N F N 
J I O C Z 


J X P Q Z 
S T Y G C 
H G G G X 
O B J E P 


No. 2 


R Q D A R 
I G P J R 
A F M E L 
E K W F E 
P P T V H 


C J A J E 
G M V X O 
Y K E R E 
J X B L Q 
J T U C Q 


A E H T M 
Z U S U N 
F C U I Z 
L 0 R B E 
G F T I R 


U L Q P H 
A U Y Y H 
S Z N M G 
J P H C G 


Q X W J Z 
Z M Y N V 
H N Z N Q 
H I C E W 


No. 3 


S Q D A R 
G I P J R 
C D M E L 


C J A J E 
G M V Z M 
W K E R G 


EMUFE JVBLQ 

PNVVJ JJUCQ 


A E H R O 

Z W S U N 

D C W I Z 

N O R B E 

G H T I R. 


U N 0 P F 
C U A W H 
Q Z L O G 
J N H A I 


Q V W H Z 
X M W P V 
J N B N S 
H K C G U 
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CHAPTER 9 


ANALYSIS OF THE HAGELIN CRYPTOGRAPH 
GENERAL SOLUTION 

The general solution of the HAGELIN CRYPTOGRAPH has already been 
described "in principle" in Chapter 5 where the solution of a hypotheti¬ 
cal four-wheel Hagelin machine was discussed. If the reader understands 
the material presented in Chapter 5, he will have no trouble in under¬ 
standing the rationale behind the general solution. 

Thus, given a cryptogram of sufficient length (the more length, the 
easier being the general solution), just as was done in Chapter 5, the 
first step is to analyze the text of the cryptogram divided into the 
"period" of its shortest wheel-length (so that a maximum amount of text 
per wheel-pin is obtained). In the case of the Model Type C-48 machine 
(M-209), the shortest wheel-length is 17. Therefore, 17 distributions 
are initially obtained from the cryptogram, each representing every 17th 
letter of ciphertext. 

The 17 distributions may be considered as divided into two classes, 
termed Class A and Class B, where one class represents a "pin" of Wheel 
17 in a non-effective (inactive) position, and the other a "pin" in an 
effective (active) position. The object of initial analysis is to 
divide or separate the 17 distributions into the two classes. 

The reader should here understand the "concept" that for any given 
number of wheels, there will result ciphertext which will be a "combin¬ 
ation" of a given number of different monoalphabetic substitutions. The 
simplest case, for example, is that of one wheel which results in cipher- 
text which is a "combination" of two monoalphabetic substitutions, one 
being the text resulting when the "pin" of the wheel is in a non-effect¬ 
ive position (key of 0) and the other being the text resulting when the 
"pin" is in an effective position (key = number of "lugs" on wheel). The 
following table shows the number of different monoalphabetic substitu¬ 
tions which combine to form the result of a given number of wheels: 
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Number of 
Wheels 


Substitutions which Combine 


Nimiber of Monoalphabetic 


1 


2 


2 


4 


3 


8 


4 


16 


5 


32 


6 


64 


It is seen that the resulting ciphertext of a six-wheel Hagelin system 
"in effect" is a "combination" of 64 different monoalphabetic substitutions. 
In the case of the 17 distributions initially obtained from the cryptogram, 
the letters within a single distribution are the result of the other five 
wheels and represent a "combination" of 32 monoalphabetic substitutions. 

That is, text within a single distribution represents a "combination" of 
32 different monoalphabetic substitutions. More specifically. Class A 
represents one set of 32 different monoalphabetic substitutions and Class B 
represents another set of 32 different monoalphabetic substitutions. 

Following the above, the reader should understand the concept of "degree 
of randomness". Thus, a combination of 32 monoalphabetic substitutions is 
not purely random, though more random, for example, than if only 16 
different monoalphabetic substitutions were combined. In other words, a 
single monoalphabetic substitution provides ciphertext which is obviously 
not random, some letters occur more frequently than others, others less 
frequently, etc. If two different monoalphabetic substitutions are combined, 
the resulting ciphertext again will not be random, though more random than 
the single monoalphabetic substitution. If four different monoalphabetic 
substitutions are combined, again the resulting ciphertext will still not be 
completely random, and so forth. Therefore, in the case of the 17 distribu¬ 
tions, given sufficient text, we should be able to match the distributions 
into two classes, where one class consists of text resulting from one set of 
32 different monoalphabetic substitutions and the other class consists of 
text resulting from another set of 32 different monoalphabetic substitutions. 

In Chapter 5 we were able to match the distributions fairly easily as only 
four wheels were involved, such that the text within a distribution came from 
but only eight monoalphabetic substitutions. Since we are now dealing with 
32 monoalphabetic substitutions, it is evident that we need more text 
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to successfully differentiate between the two classes of text. It should 
also be noted that as the mathematical computations will be much larger 
than those of Chapter 5, the task of matching distributions in the general 
solution will probably require use of a computer. In fact^ without benefit 
of a computer, matching distributions in the general solution is a monu¬ 
mental task; not that it cannot be done by hand, however, given sufficient 
time and manpower. 

After successfully dividing the 17 distributions into two classes, in 
effect we will have found the effective and non-effective "pins” of Wheel 
17, though we still will not know which class represents the effective 
"pins" and which the non-effective "pins". 

At this point in solution, using the almost necessary computer we might 
combine all distributions of one class and combine all distributions of the 
other class. Then, as was done in Chapter 5, by shifting one of the 
combined distributions through each of 26 positions, we might attempt to 
match the two classes of distributions, thus determining the number of 
"lugs" on Wheel 17. 

After initial success with Wheel 17, we might turn to Wheel 19; and 
following the same procedure, we might attempt to divide the 19 distribu¬ 
tions into two classes, i.e., find the "pin-settings" of Wheel 19. 

In summary, the general solution follows the general procedure of 
Chapter 5. 

One final point, though we have been up to this point considering a 
single long cryptogram as forming the text for the general solution, it is 
possible to combine several shorter cryptograms in order to obtain suffi¬ 
cient text for the general solution. This does not mean, however, that we 
can simply add, right and left, the texts of different messages. Instead, 
mathematically, again using the computer, we can attempt to match the 17 
distributions of one cryptogram against the 17 distributions of another 
cryptogram — shifting the distributions of one of the cryptograms through 
each of 17 "shifts" until the total 17 distributions of one message "match" 
the total 17 distributions of the other message. At this point Wheel 17 
of both cryptograms will be in the same effective position; and for the 
purpose only of recovering the "pin-settings" of Wheel 17 (separating the 
17 distributions into two classes), the two cryptograms may be combined. 
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We are indebted to Greg Mellen for providing the four problems that 
follow. All four use the same pin and lug-settings; only the wheel- 
settings are different for each message. (It is likely that a computer 
will be required to solve these cryptograms.) 


60. J A Y G Z 
N Y C Q Q 
A D U V B 
J Z R Q Z 
S I X O Q 

E J Z R U 
K G W Y H 
X C K D K 
T N H K E 
E E H L T 

J D R M J 
E S Z T N 
W E J E N 
S L P S K 
H S X A K 

B D N W V 
M E S D E 
F G 0 G B 
U L W X W 
E N W M R 

C S X C I 
F M M V M 
J J A E O 
X M E H E 
H A N E E 

F B E N B 
B Z W Q G 
S R Z S E 


D G V H G X M 
E C R J Q H G 
P M X R O F F 
K I R C K L M 
M F L S V PL 

0 D L H P A I 
B W A T Y AY 
I O A B G R M 
G V S I P L C 
N A G H B B M 

U K Y I N J H 
W P Q A D G G 
U H I P X X M 
X U N W B I M 
R G R I H V R 

M S R R C O G 
K L Q V R P J 
Q L S Z V K C 

Y T S R P R W 

V Y M U G K U 

F G S N C CM 

Y V Q D E ID 
U N J S Y J J 
Z Z O E H E Y 
Z G G A A T U 

X H O P N K R 
F A X M K U C 

V J F I X T D 


PROBLEMS 

C R R H D T S 
K T V J Z J B 
Z W E J D Y D 
J U L X Y X N 
P V H T T F W 

Z W N L V L R 
WOW P N M Q 
MOP Z L B D 
C P M N K N W 
L B E E Q H N 

S M E Y V O T 
S E H N M S L 
O V K H U J Q 
Z V C U S Y P 
O M P B G J E 

Q S I L U I E 
C W W B Q B 0 
D A H C V O S 
T O Z B S U G 
T Q D I X J V 

H W H W M K I 
YAK S F Q H 
C N Z I D L S 
L J J U G V D 
Y V D H V C D 

G L Q H J V Z 
E B J P K S M 
Q Z K D C Q L 


F S S T M I 
D T M R L H 
Q M W D P N 
M P P E K M 
X Z I D R S 

B J I Y N C 
S W L Z J E 
A R F H A T 
B R G B P I 
S W F P 0 R 

T Q N T H Z 
H Q V K A Q 
W Y S P G 0 
0 Y I H S Y 

V G M P N S 

U I I J D X 
J C I U G Y 
B L V Q Z K 
T H W O V T 
Z L W I I L 

V Q M W A E 
U C B U V I 
J O S V T Z 
N Q X C P P 
D A R Y K P 

E T B S R H 
O U U E Y N 
E S S T M H 
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CHAPTER 10 


ANALYSIS OF THE HAGELIN CRYPTOGRAPH 
MODEL TYPE CD-57 


A more recent version of the HAGELIN CRYPTOGRAPH is the Model Type 
CD-57. Louis Kruh, in the July issue of Cryptologia* describes in some 
detail the Hagelin Pocket Cryptographer, Type CD-57, as it is termed by 
its manufacturer. Essentially, the device is a compact unit, 3-1/4" wide, 
5-1/8" long, 1-1/2" thick and weighs about 23 ounces. Cryptographically, 
the CD-57 is in the "family" of HAGELIN CRYPTOGRAPHS, but there are some 
differences between the CD-57 and, for example, the Model Type C-48 
machine (M-209) which has been discussed to this point. 

The following Beaufort Tableau shows the cryptographic process of the 
CD-57, where given any two elements, the third element may be found; 
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*A quarterly journal devoted to the science of cryptology. Address: Albion 
College, Albion, Michigan 49224. 
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The reader should compare this Beaufort Tableau for the CD-57 with 
the Hagelin Tableau (also a form of Beaufort Tableau) for the Type C-48 
Cipher Device (M-209) shown on page 2. Both tableaus are reciprocal; 
that is, for example, if A + R = a given key, the A may be ciphertext and 
the R plaintext, or vice versa. But note the differences between the two 
tableaus: 

(1) In the Hagelin Tableau for the Type C-48 Cipher Device (M-209), the 
possible keys run from j3 to 27, but in the case of the CD-57 *s Beaufort 
Tableau, the possible keys from from 0 to 40, with the pairs of keys, 0 
and 26, 1 and 27, 2 and 28, ... 14 and 40 being the same. Thus, in the 
CD-57 system a key of 10 and a key of 36 have the same effect insofar as 
encipherment or decipherment is concerned. 

(2) In the Hagelin Tableau for the Type C-48 Cipher Device (M-209), the 
relationship between letters and the key is fixed; that is, it is invari¬ 
able that A + R = 18. But in the case of the Beaufort Tableau for the 
CD-57 (and this is not shown on the tableau itself), the realtionships 

of the letters with the keys shown is true only when the letter A on the 
"outer alphabet ring" of the CD-57 is exactly at the top of the device. 

As the "outer alphabet ring” may be turned manually and set at any one 
of 26 positions for any particular message encipherment/decipherment, 
the keys shown may be relatively different. Thus, for example, if the 
letter E on the "outer alphabet ring" is set at the top of the device, 
rather than the normal letter A, the keys shown in the Beaufort Tableau 
must be increased by 4. 

Let us consider now a CD-57 problem. In the July 1977 issue of 
Cryptologia, previously mentioned, Louis Kruh, in addition to describing 
the Hagelin Pocket Cryptographer, Type CD-57, at the same time offered 
his readers a "chance to test their cryptanalytic skills" by solving two 
given messages, both enciphered with the Hagelin Type CD-57 cipher 
machine. The problem presented by Louis Kruh is the following: 

The following two messages were given: 

Message Number One 


p 

Z 

u 

Y 

V 

N 

B 

I 

Y 

E 

R K 

G 

N 

L 

N 

L 

E 

B 

0 

Q 

Z 

D 

W Q 

z 

V 

V 

R 

D 

G 

Y 

K 

N 

P 

R Q 

X 

S 

M 

Q 

T 

A 

I 

G 

Y 

F 

Z 

Z V 

K 

X 

u 

T 

N 

X 

K 

R 

G 

I 

L Z 

0 

Z 

Q 

Q 

S 

C 

0 

X 

E 

Z 

N 

J A 
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w 

A 

T 

R 

M 

B 

F 

C 

W 

A 

W K 

E 

N 

Q 

H 

H 

X 

Z 

I 

W 

Y 

X 

G 

P 

0 

Y 

X 

I 

D 

N 

T 

E 

W 

N 

D N 

F 

T 

P 

A 

R 

L 

K 

H 

T 

F 

T 

N 

C 

c 

Z 

C 

Z 

W 



























Message Number 

Two 











0 

C 

C 

A 

G 

J 

Y 

Q 

Y 

M 

u z 

K 

K 

N 

B 

K 

E 

Y 

K 

F 

E 

E 

P 

Q 

z 

Y 

W 

N 

N 

G 

D 

Z 

L 

G 

Q Y 

U 

Z 

P 

L 

T 

U 

A 

M 

T 

R 

F 

W 

B 

c 

Z 

R 

K 

D 

G 

F 

T 

N 

L 

z c 

0 

G 

F 

K 

X 

R 

W 

R 

Y 

W 

A 

Y 

S 

w 

Z 

B 

G 

M 

S 

G 

A 

N 

D 

E Q 

Y 

D 

A 

R 

R 

X 

N 

L 

Q 

X 

F 

W 

S 

s 

E 

R 

E 

A 

G 

Q 

T 

A 

M 

Q D 

T 

H 

B 

Q 

A 

M 

H 

0 

F 

N 

L 

F 

U 

w 

W 

A 

S 

K 





















In addition, the following information concerning the two messages 
was provided: 

"The key wheels used have 26, 38, 42, 34, 46 and 25 pins 
respectively, and less than 50% of each are in active 
positions. In addition, the key setting of the second 
half of Message One overlaps with the key setting of the 
first half of Message Two, and the word artillery is in 
both of these sections. Other clues may be discerned in 
the photographs accompanying the text." 

The first step, as has been exemplified in most of the problems in 
previous chapters, is to put the two given messages properly "in depth", 
then to recover or "strip off" as much keying sequence as possible. 

We are given the fact that "the key setting of the second half of 
Message One overlaps with the key setting of the first half of Message 
Two." If we take this "fact" to be literally true, since each message 
contains 130 letters, we can say that the last 65 letters of Message One 
have been enciphered with the same keying sequence as the first 65 letters 
of Message Two. Further, we are given the information that the word 
artillery occurs within the overlap portion of both messages. 

Therefore, appropriately overlapping the two messages, we can run the 
plaintext word artillery through Message Two, simultaneously obtaining 
resultant text in Message One. When "good" plaintext occurs in Message 
One, we will know that we have likely found the correct position of the 
word artillery in Message Two. The following is the result of this 
tabulation: 
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Lti 

sag 

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

29 

30 

31 

32 

33 

34 

35 

36 

37 

38 

39 

40 

41 

42 

43 

44 

45 

46 

47 

48 

49 

50 

51 


Message 

Two 


Message 

One 


Resultant plaintext in Message One when 
word "artillery” occurs in Message Two 


0 

C 

C 

A 

G 

J 

Y 

Q 

Y 
M 
U 
Z 
K 
K 
N 
B 
K 
E 

Y 
K 
F 
E 
E 
P 

Q 

z 

Y 
W 
N 
N 
G 
D 
Z 
L 
G 

Q 

Y 
U 
Z 
P 
L 
T 
U 
A 
M 
T 
R 
F 
W 
B 
C 
Z 


Q 

S 

C 

0 

X 

E 

z 

N 

J 

A 

W 

A 

T 

R 

M 

B 

F 

C 

W 

A 

W 

K 

E 

N 

Q 

H 

H 

X 

Z 

I 

w 

Y 
X 
G 
P 
0 

Y 
X 
I 
D 
N 
T 
E 
W 
N 
D 
N 
F 
T 
P 
A 
R 


YBTUUQDUN 

KRFRQKHGK 

ADCNKOTDW 

MAYHOAQPX 

JWSLAXCQP 

FQWXXJDIR 

ZUIUJKVKZ 

DGFGKCXSY 

PDRHCEFRD 

MPSZEMEWA 

YQKBMLJTA 

ZIMJLQGTI 

RKUIQNGBH 

TSTNNNOAS 

BRYKNVNLY 

AWVKVWYRA 

FTVSUFETY 

CTDRFLGRQ 

CBCCLNEJP 

KANINLWIX 

JLTKLDVQM 

URVIDCDFD 

ATTACKSWI 

CRLZKZJBD 

AJKHZQOWA 

SISWQVJTD 

RQHNVQGWP 

ZFYSQNJIA 

OWDNNQVTY 

FBYKQCGRV 

KWVNCNEOP 

FTYZNLBIK 

CWKKLIVDW 

FIVIICQPY 

RTTFCXCRO 

CRQZXJEHC 

AOKUJLUVX 

XIFGLBIQO 

RDRIBPDHC 

MPTYPKUVY 

YRJMKBIRB 

AHXHBPEUK 

QVSYPLHDA 

EQJMLOQTG 

ZHXIOXGZE 

QVTLXNMXY 

ERWUNTKRU 

AUFKTRENL 

DDVQRLAEY 

MTBOLHRRY 

CZZIHYERY 

IXTEYLERH 
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53 

54 

55 

56 

57 


R 

K 

D 

G 

F 


L 

K 

H 

T 

F 


GRPVLLEAV 

ANGILLNOB 

WETILUBUK 

NRTIUIHDF 

ARTRIOQYH 


Success! It is seen that if the word artillery begins in position 23 
in Message Two , the resultant plaintext in Message One will be attacks wi y 
almost surely "good" plaintext. Thus, the overlap with the two messages 
correctly positioned is as follows: 

key- 


#1 - 

Q 

S 

C 

0 

X 

E 

Z 

N 

J 

A 

W 

A 

T 

R 

M 

B 

F 

C 

W 

A 

W 

K 

#2 - 

0 

C 

C 

A 

G 

J 

Y 

Q 

Y 

M 

U 

Z 

K 

K 

N 

B 

K 

E 

Y 

K 

F 

E 


1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

key- 

4 

6 

9 

7 

9 

7 

17 

4 

4 














#1 - 

E 

N 

Q 

H 

H 

X 

Z 

I 

W 

Y 

X 

G 

P 

0 

Y 

X 

I 

D 

N 

T 

E 

W 


a 

t 

t 

a 

c 

k 

s 

w 

i 














#2 - 

E 

P 

Q 

Z 

Y 

W 

N 

N 

G 

D 

Z 

L 

G 

Q 

Y 

U 

Z 

P 

L 

T 

U 

A 


a 

r 

t 

i 

1 

1 

e 

r 

y 















23 

24 

25 

26 

27 

28 

29 

30 

31 

32 

33 

34 

35 

36 

37 

38 

39 

40 

41 

42 

43 

44 

key- 























#1 - 

N 

D 

N 

F 

T 

P 

A 

R 

L 

K 

H 

T 

F 

T 

N 

C 

C 

Z 

C 

Z 

W 


#2 - 

M 

T 

R 

F 

W 

B 

C 

Z 

R 

K 

D 

G 

F 

T 

N 

L 

Z 

C 

0 

G 

F 



45 

46 

47 

48 

49 

50 

51 

52 

53 

45 

55 

56 

57 

58 

59 

60 

61 

62 

63 

64 

65 



By "matching" the word artillery in Message Two against resultant text 
in Message One, we have recovered a small portion of the keying sequence, 
the keys between positions 23 and 31. By a "trial-and-error" process we 
may now attempt to recover additional keying sequence. In essence, we 
try to guess plaintext in one of the messages, and then confirm the guess 
by obtaining "good" plaintext in the other message. For example, if we 
guess that the word enemy comes in front of the word attacks in Message 
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Oner not an unlikely possibility, the letters elude are obtained in 
Message Two. We are obviously on the right track! Finallyr of courser 
we shall not forget that the word artillery also occurs in Message One. 

In this mannerr some 39 successive keys are quickly recovered as follows: 


key- 


















6 

9 

4 

8 

8 

#1 - 

Q 

S 

C 

0 

X 

E 

Z 

N 

J 

A 

W 

A 

T 

R 

M 

B 

F 

C 

W 

A 

W 

K 



















e 

n 

e 

m 

y 

#2 - 

0 

C 

C 

A 

G 

J 

Y 

Q 

Y 

M 

U 

Z 

K 

K 

N 

B 

K 

E 

Y 

K 

F 

E 



















c 

1 

u 

d 

e 


1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

key- 

4 

6 

9 

7 

9 

7 

17 

4 

4 

17 

4 

6 

6 

7 

6 

8 

19 

7 

4 

17 

9 

4 

#1 - 

E 

N 

Q 

H 

H 

X 

Z 

I 

W 

Y 

X 

G 

P 

0 

Y 

X 

I 

D 

N 

T 

E 

W 


a 

t 

t 

a 

c 

k 

s 

w 

i 

t 

h 

a 

r 

t 

i 

1 

1 

e 

r 

y 

f 

i 

#2 - 

E 

P 

Q 

Z 

Y 

W 

N 

N 

G 

D 

Z 

L 

G 

Q 

Y 

u 

Z 

P 

L 

T 

U 

A 


a 

r 

t 

i 

1 

1 

e 

r 

y 

o 

f 

V 

a 

r 

i 

o 

u 

s 

t 

y 

P 

e 


23 

24 

25 

26 

27 

28 

29 

30 

31 

32 

33 

34 

35 

36 

37 

38 

39 

40 

41 

42 

43 

44 

key- 

4 

7 

4 

9 

9 

9 

4 

9 

4 

10 

15 

10 











#1 - 

N 

D 

N 

F 

T 

P 

A 

R 

L 

K 

H 

T 

F 

T 

N 

C 

C 

Z 

C 

z 

W 



r 

e 

r 

e 

q 

u 

e 

s 

t 

a 

i 

r 











#2 - 

M 

T 

R 

F 

W 

B 

C 

Z 

R 

K 

D 

G 

F 

T 

N 

L 

Z 

C 

0 

G 

F 



s 

o 

n 

e 

n 

i 

c 

k 

n 

a 

m 

e 












45 

46 

47 

48 

49 

50 

51 

52 

53 

54 

55 

56 

57 

58 

59 

60 

61 

62 

63 

64 

65 



A frequency count is made of the 39 recovered keys: 

9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 
11 56282 1 3 1 

The frequency count brings to light the interesting fact that the number 
of different keys appears to be limited! ThuSr two keysr 4 and 9, account 
for almost 50% of all keys used; andr indeedr seven keySr 4r 6, 7, 8, 9, 

10r and 17r account for almost 95%. From the limited number of different 
keys appearingr we can make certain deductions: 

(1) As no key of 0 appears, which would be the key when all "pins** are 
non-effective^ it appears likely that the "outer alphabet ring" of the 
CD-57 has been turned so that the letter A does not appear at the top of 
the device. 
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(2) Further, as the smallest key, 4, occurs so frequently (11 times), 
it would appear that 4 might well represent "all wheels non-effective.'* 

This being correct, then the letter E on the "outer alphabet ring" of the 
CD-57 will be at the top of the device, rather than the letter A. 

(3) Therefore, reducing all keys by 4, shows that the keying sequence 
now contains the following adjusted keys: 0, 2, 3, 4, 5, 6, 11, 14, and 
15. These are the keys which we shall work with in the second step of 
our solution, recovering the "pin-settings" of the wheels themselves. 

(4) One conclusion which we can reach by examination of these reduced 
keys is that it appears that the vast majority of pins on the wheels must 
be in non-effective positions! Thus, it appears that when an adjusted 
key of 2, 3, 4, 5, or 6 has occurred, it is because only one wheel is 
active, the others being inactive! Thus, the number of "lugs" on the 
wheels are likely 2, 3, 4, 5, and 6, with no wheel containing one "lug" 
(since no adjusted key of 1 occurs). 

In the CD-57 system, just as in all the HAGELIN CRYPTOGRAPHS, a key 
is the result of the summation of the "lugs" (or amount of "kick") of 
individual active wheels. One important difference, however, between the 
CD-57 and the previous HAGELIN CRYPTOGRAPHS discussed is that in the CD-57 
there are no "overlaps" between wheel "lug-settings." Thus, in the CD-57 

system, a resulting key is always the summation of individual wheel lugs, 

there being no possibility of "overlaps" as were described in Chapter 4. 

The fact that no "overlaps" are possible in the CD-57 system makes things 
obviously easier for the cryptanalyst! 

The method of recovering "pin-settings" of the wheels is exactly the 
same as that described in previous chapters. We shall begin by examining 
the wheel with the fewest number of pins. Wheel 25. (Remember we were given 
the information that the key wheels used have 26, 38, 42, 34, 46, and 25 
pins respectively.) With the 39 recovered keys of the keying sequence put 
into a "period" of 25 we have the following: 

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 

2 5 0 4 4 0 2 5 3 5 3 13 0 0 13 0 2 2 3 2 4 15 3 0 13 

500305550506 11 6 

Since we have reached the conclusion, above, that the number of "lugs" on 
the wheels likely are 2, 3, 4, 5, and 6 (with no wheel containing one lug). 
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we might, here, assume or guess that Wheel 25 contains 6 lugs. In other 
words, if no favorable results are obtained with Wheel 25 containing 6 
lugs, for example, we might try Wheel 26 to contain 6 lugs, etc. There¬ 
fore, let us assume at this point that Wheel 25 does contain 6 lugs. 

Then every key less than 6 must be the result of Wheel 25 being non- 
effective, and the appropriate "pins" may be indicated with a minus (-) 
sign, as follows; 

1234 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 

2 5 0~4 4 0 2 5 3 5 TTs 0 0~T3 0 2 2 3 2 TTs 3 0^ 

500305550506 11 6 


It appears that all pins are non-effective, except four, unidentified! 
Here we take a "short cut"! But who can blame the cryptanalyst for not 
taking the "path of least resistance"! In the Cryptologia article of 
Louis Kruh (where this problem was offered), there appeared the following 
picture: 



Examining Wheel 25 closely, knowing that pins turned outward toward the 
rim of the wheel are "effective", we note the following "effective" and 
"non-effective" pins; 

ABCDEFGHIJKLMNOPQRSTUVXYZ 
- +__ +-+-+-- 

All pins of Wheel 25 are seen to be "non-effective", except four! Will 
the four "effective" pins now match the four unidentified pins of our 


100 






identifications above? Again^ success! Wheel 25 matches perfectly the 
identifications made, and we have the following: 

Wheel 25 

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 

25044025353 13 00 13 022324 15 30 13 

500305550506 11 6 

VXYZABCDEFGHIJKLMNOPQRSTU 

In a similar manner, the pins of the remaining five wheels may be 
identified, effective or non-effective; and at the same time, the number of 
lugs, or the amount of kick, of each wheel may be found. 

A portion of the complete cryptographic operation of the CD-57 is shown 
as follows: 


Message One - 

Q 

S 

C 

0 

X 

E 

Z 

N 

J 

A 

W 

A 

T 

R 

M 

B 

F 

C 

W 

A 


r 

r 

e 

i 

n 

f 

o 

r 

c 

e 

m 

e 

n 

t 

s 

i 

f 

e 

n 

e 

Message Two - 

0 

C 

C 

A 

G 

J 

Y 

Q 

Y 

M 

U 

Z 

K 

K 

N 

B 

K 

E 

Y 

K 


t 

h 

e 

w 

e 

a 

P 

o 

n 

s 

o 

f 

w 

a 

r 

i 

a 

c 

1 

u 

Key - 

7 

9 

6 

22 

10 

9 

13 

4 

11 

4 

8 

4 

6 

10 

4 

9 

10 

6 

9 

4 

Reduced Key - 

3 

5 

2 

18 

6 

5 

9 

0 

7 

0 

4 

0 

2 

6 

0 

5 

6 

2 

5 

0 

Wheel 25 (6)- 





















Wheel 46 (5)- 

- 

+ 

- 

+ 

- 

+ 

- 

- 

+ 

- 

- 

- 

- 

- 

- 

- 

- 

- 

+ 

- 

Wheel 34 (4)- 


Wheel 42 (3)- 





















Wheel 38 (2)- 


















+ 

- 

- 

Wheel 26 (2)- 

- 

- 

+ 

- 

- 

- 

- 

- 

+ 

- 


- 

+ 

- 

- 

+ 

- 

- 

- 

- 


Plaintext of Message Two: THE WEAPONS OF WAR lACLUDE ARTILLERY OF 

VARIOUS TYPES ONE NICKNAME FOR THESE GUNS 
IS LONG RIFLES THE REASON IS THAT THEIR 
RANGE CAN EXTEND FOR SEVERAL MILES X. 

(One "garbled" letter, incidentally, is noted in the fifth word.) 

Concerning solution of the above CD-57 problem, cryptanalysis was 
assisted by such things as: 

(1) The vast majority of "pins" of the wheels were in a non-effective 
position. 

(2) Each wheel contained a very limited number of "lugs". 

(3) Knowledge that the overlap portion of both messages contained the 
word artillery . 

(4) Photographs provided the relative position of "pin-settings" on 
all wheels. 

(5) The specific order of the wheels was provided. 
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Let us now look at another CD-57 problem. This one, a challenge 


problem, was provided the author by Roger Stuart Brown, MD. This is 


the problem of Dr. Brown: 


Cryptogram: M 

Z 

A Q 

Y 

J 

R 

I 

S 

G 

A 

0 

J 

C 

C 

T 

Q 

p 

B 

0 

J 

B 

S 

A D 

W 

0 

M L 

X 

L 

J 

A 

0 

U 

E 

U 

S 

K 

B 

J 

p 

X 

R 

E 

B 

U 

X 

E C 

Q 

S 

M M 

S 

N 

U 

G 

M 

H 

Q 

S 

E 

E 

M 

Q 

s 

c 

Q 

Z 

Z 

X 

K 

D R 

W 

V 

Z G 

F 

U 

Q 

W 

K 

F 

Y 

W 

R 

Y 

X 

z 

u 

X 

G 

L 

Z 

H 

C 

R Q 

G 

P 

R L 

A 

Y 

s 

P 

A 

C 

Y 

E 

X 

X 

X. 











Given: (1) Message beginning: "TO MY DEAR FRIEND PATRICK ALBERT 

JOHNSON I SEND TO YOU THE FOLLOWING 
MESSAGE... " 


(2) Having solved one previous cryptogram in the CD-57 
system of Dr. Brown, it is likely that the Hagelin 
Pocket Cryptographer, Type CD-57, used by Dr. Brown 
to encipher the present message has been used with 
the letter A of the "outer alphabet ring" at the top 
of the device, so that the Beaufort Tableau on page 93 
is directly applicable without any adjustment necessary 
to the key. Further, it is likely that the following 
wheels and "lugs" have been used: 


Wheel 29 
Wheel 31 
Wheel 37 
Wheel 41 
Wheel 43 
Wheel 47 


1 lug 

2 lugs 
4 lugs 
6 lugs 
11 lugs 
16 lugs 


Let us now solve the problem. 

The first step is to recover as much of the keying sequence as possible. 
Matching the given "message beginning" against the text of the cryptogram, 
we can easily recover the following keying sequence: 


Cryptogram: M 

Z 

A 

Q 

Y 

J 

R 

I 

S 

G 

A 

0 

J 

C 

c 

T 

Q 

P 

B 

0 

J 

Plaintext: t 

o 

m 

y 

d 

e 

a 

r 

f 

r 

i 

e 

n 

d 

p 

a 

t 

r 

i 

c 

k 

Key: 5 

13 

12 

14 

1 

13 

17 

25 

23 

23 

8 

18 

22 

5 

17 

19 

9 

6 

9 

16 

19 

B 

S 

A 

D 

W 

0 

M 

L 

X 

L 

J 

A 

0 

U 

E 

U 

S 

K 

B 

J 

P 

a 

1 

b 

e 

r 

t 

j 

o 

h 

n 

s 

o 

n 

i 

s 

e 

n 

d 

t 

o 

y 

1 

3 

1 

7 

13 

7 

21 

25 

4 

24 

1 

14 

1 

2 

22 

24 

5 

13 

20 

23 

13 

X 

R 

E 

B 

U 

X 

E 

C 

Q 

S 

M 

M 

S 

N 

U 

G 

M 

H 

Q 

S 

E 

o 

u 

t 

h 

e 

f 

o 

1 

1 

o 

w 

i 

n 

g 

m 

e 

s 

s 

a 

g 

e 

11 

11 

23 

8 

24 

2 

18 

13 

1 

6 

8 

20 

5 

19 

6 

10 

4 

25 

16 

24 

8 


At this point, let us examine the various "lug totals” (keys) which 
might arise from the 64 possible "pin-settings" of the six-wheels: 
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1 

2 

4 

6 

11 

16 


key 

1 

2 

4 

6 

11 

16 


key 

1- 

0 

0 

0 

0 

0 

0 

= 

0 

33- 0 

0 

0 

0 

0 

16 

= 

16 

2- 

1 

0 

0 

0 

0 

0 

= 

1 

34- 1 

0 

0 

0 

0 

16 

= 

17 

3- 

0 

2 

0 

0 

0 

0 

= 

2 

35- 0 

2 

0 

0 

0 

16 

= 

18 

4- 

0 

0 

4 

0 

0 

0 

= 

4 

36- 0 

0 

4 

0 

0 

16 

= 

20 

5- 

0 

0 

0 

6 

0 

0 

= 

6 

37- 0 

0 

0 

6 

0 

16 

= 

22 

6- 

0 

0 

0 

0 

11 

0 

= 

11 

38- 0 

0 

0 

0 

11 

16 

= 

27 

7- 

1 

2 

0 

0 

0 

0 

= 

3 

39- 1 

2 

0 

0 

0 

16 

= 

19 

8- 

1 

0 

4 

0 

0 

0 

= 

5 

40- 1 

0 

4 

0 

0 

16 

= 

21 

9- 

1 

0 

0 

6 

0 

0 

= 

7 

41- 1 

0 

0 

6 

0 

16 

= 

23 

10- 

1 

0 

0 

0 

11 

0 

= 

12 

42- 1 

0 

0 

0 

11 

16 

= 

28 

11- 

0 

2 

4 

0 

0 

0 

= 

6 

43- 0 

2 

4 

0 

0 

16 

= 

22 

12- 

0 

2 

0 

6 

0 

0 

= 

8 

44- 0 

2 

0 

6 

0 

16 

= 

24 

13- 

0 

2 

0 

0 

11 

0 

= 

13 

45- 0 

2 

0 

0 

11 

16 

= 

29 

14- 

0 

0 

4 

6 

0 

0 

= 

10 

46- 0 

0 

4 

6 

0 

16 

= 

26 

15- 

0 

0 

4 

0 

11 

0 

= 

15 

47- 0 

0 

4 

0 

11 

16 

= 

31 

16- 

0 

0 

0 

6 

11 

0 

= 

17 

48- 0 

0 

0 

6 

11 

16 

= 

33 

17- 

1 

2 

4 

0 

0 

0 

= 

7 

49- 1 

2 

4 

0 

0 

16 

= 

23 

18- 

1 

2 

0 

6 

0 

0 

= 

9 

50- 1 

2 

0 

6 

0 

16 

= 

25 

19- 

1 

2 

0 

0 

11 

0 

= 

14 

51- 1 

2 

0 

0 

11 

16 

= 

30 

20- 

1 

0 

4 

6 

0 

0 

= 

11 

52- 1 

0 

4 

6 

0 

16 

= 

27 

21- 

1 

0 

4 

0 

11 

0 

= 

16 

53- 1 

0 

4 

0 

11 

16 

= 

32 

22- 

1 

0 

0 

6 

11 

0 

= 

18 

54- 1 

0 

0 

6 

11 

16 

= 

34 

23- 

0 

2 

4 

6 

0 

0 

= 

12 

55- 0 

2 

4 

6 

0 

16 

= 

28 

24- 

0 

2 

4 

0 

11 

0 

= 

17 

56- 0 

2 

4 

0 

11 

16 

= 

33 

25- 

0 

2 

0 

6 

11 

0 

= 

19 

57- 0 

2 

0 

6 

11 

16 

= 

35 

26- 

0 

0 

4 

6 

11 

0 

= 

21 

58- 0 

0 

4 

6 

11 

16 

= 

37 

27- 

1 

2 

4 

6 

0 

0 

= 

13 

59- 1 

2 

4 

6 

0 

16 

= 

29 

28- 

1 

2 

4 

0 

11 

0 

= 

18 

60- 1 

2 

4 

0 

11 

16 

= 

34 

29- 

1 

2 

0 

6 

11 

0 

= 

20 

61- 1 

2 

0 

6 

11 

16 

= 

36 

30- 

1 

0 

4 

6 

11 

0 

= 

22 

62- 1 

0 

4 

6 

11 

16 

= 

38 

31- 

0 

2 

4 

6 

11 

0 

= 

23 

63- 0 

2 

4 

6 

11 

16 

= 

39 

32- 

1 

2 

4 

6 

11 

0 

= 

24 

64- 1 

2 

4 

6 

11 

16 

= 

40 


The problem facing the cryptanalyst may be illustrated by turning to 
the recovered keying sequence, above, and looking apecifically at 
D + e = 7. Actually, when looking at the Beaufort Tableau shown on 
page 93, it is seen that a key of 7 and a key of 33 are the same. That 
is, though we have shown that D + e = 7, it might actually have been 
D + e = 33. Thus, the "pin-setting" giving rise to D + e might be any 
one of the following four: 


12 4 

9-100 
17-1 2 4 

48-0 0 0 

56-0 2 4 


6 11 16 
6 0 0 = 7 

0 0 0 = 7 

6 11 16 = 33 

0 11 16 = 33 


It is noted that from D + e = 7/33 not a single pin can be identified as 
effective or non-effective. But consider other recovered keys. For 
example, consider in the above keying sequence Q + t = 9. As a key of 9 
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and a key of 35 are the same^ Q + t can only arise from one of the follow¬ 
ing two "pin-settings": 


1 2 4 6 11 16 

18- 120600 = 9 

57- 0 2 0 6 11 16 = 35 

Though we are not sure which "pin-setting" has given rise to Q + t, we 
can say with certainty that — 

Wheel 31 with 2 lugs is "effective" 

Wheel 37 with 4 lugs is "non-effective" 

Wheel 41 with 6 lugs is "effective" 

Thus, given the lug-settings 1, 2, 4, 6, 11, and 16, we can prepare a 
table that will indicate the "effectiveness" of specific lugs when various 
keys have arisen. The table follows: 



Examining the table it is seen that the "effectiveness" of the wheel 
containing 2 lugs is frequently indicated from the keys. Thus, in our 
problem the wheel with 2 lugs makes a good "target" for the recovery of 
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"pin-settings" from the so-far recovered keying sequence. As we know that 


Wheel 31 

contains 2 lugs, we may write 

the 

recovered keying 

sequence in a 

"period" 

of 31, and beside 

each key we 

may 

indicate where possible the 

"effectiveness" of Wheel 31 

* s "pin" in 

that 

position: 


Position 





Composite of 

on 

1st round 

2nd round 


3rd round 

Wheel 31*s 

Wheel 31 

of keys - Pin 

of keys - 

Pin 

of keys - Pin 

Pin-setting 

1 

5 0 

1 

0 

8 

0 

2 

13 2 

14 

2 


2 

3 

12 

1 

0 


0 

4 

14 2 

2 

- 


2 

5 

1 0 

22 

- 


0 

6 

13 2 

24 

2 


2 

7 

17 

5 

0 


0 

8 

25 2 

13 

2 


2 

9 

23 

20 

- 


- 

10 

23 

23 

- 


- 

11 

8 

13 

2 


2 

12 

18 

11 

0 


0 

13 

22 

11 

0 


0 

14 

5 0 

23 

- 


0 

15 

17 

8 

- 


- 

16 

19 2 

24 

2 


2 

17 

9 2 

2 

- 


2 

18 

6 

18 

- 


- 

19 

9 2 

13 

2 


2 

20 

16 0 

1 

0 


0 

21 

19 2 

6 

- 


2 

22 

1 0 

8 

- 


0 

23 

3 2 

20 

- 


2 

24 

1 0 

5 

0 


0 

25 

7 

19 

2 


2 

26 

13 2 

6 

- 


2 

27 

7 

10 

- 


- 

28 

21 0 

4 

- 


0 

29 

25 2 

25 

2 


2 

30 

4 

16 

0 


0 

31 

24 2 

24 

2 


2 


An interesting point regarding this recovery of the "pin-settings" 
of Wheel 31, of which we have to this point recovered all but five "pins", 
is that in the 2nd round of keys, above, there were numerous confirmations 
of the "pin-settings" already discovered or found in the 1st round. What 
this means is that even if we had not known that Wheel 31 contained the 
2 lugs, we still could have found it fairly easily because other "periods" 
would have produced conflicts between the pin-settings found in the 1st 
and 2nd rounds of keys. In other words, in the present problem, we do 
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not need to really know the correspondence of wheels to lugs in order 
to reach a successful solution. Indeed, we do not need to know even 
the size of the wheels, nor their order for that matter. What is an 
important fact to know is the number of lugs involved on each wheel. 

That is, knowing that one wheel contains 1 lug, another 2 lugs, another 
4 lugs, another 6 lugs, another 11 lugs, and another 16 lugs are 
significant facts of great importance for solution! It might be 
mentioned here that the Operating Instructions of the CD-57 indicate 
the usual advisability that the sum of the "lugs" on all wheels equal 
40. Thus, in the present problem, 1 + 2 + 4 + 6 + 11 + 16 = 40. As 
the maximum number of "lugs" on one wheel is 16, it can be seen that 
there is not an unlimited number of "lug" combinations, such that 
each wheel will have a different number of lugs and that the lugs will 
total 40. In other words, without overlaps between lug-settings, plus 
the restrictions on the number of possible lug-combinations, the CD-57 
in many respects is less secure than the original Model Type C-48 
(M-209) machine. 

Returning to the problem, with the "pin-setting" generally recovered 
on Wheel 31, it is evident that the pin-settings of the remaining wheels 
are equally vulnerable to analysis — particularly with the already 
recovered "pin-settings" of Wheel 31 used to assist in identifying other 
unknown pin-settings. Thus, solution to Dr. Brown's problem is not a 
real problem from this point; and it is left to the reader-student to 
continue the soltuion if he desires. 

In the following problems, the HAGELIN CRYPTOGRAPH, Model Type CD-57 
has been used for encipherments. 

PROBLEMS 

64. Given: (1) Message stereotype beginning: "TO COMMANDING GENERAL 
TWENTYFIRST AIRBORNE BRIGADE STOP..." 

(2) Wheels and corresponding lugs: Wheel 29 = 1 lug 

Wheel 31 = 2 lugs 
Wheel 37 = 4 lugs 
Wheel 41 = 6 lugs 
Wheel 43 = 11 lugs 
Wheel 47 = 16 lugs 

OTEIA RYTKT LVRBG UFRNE XLVQC 
BSPPB NBDWV TXIQG EQRQM RZDDZ 
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T Q O K T 
F I M I D 


TDWME WRUXD VWIKV KTWIZ 


YCJTP ZKODQ ZSVHZ. 

65. Given: (1) Message beginning: ”WEEKLY INTELLIGENCE SUMMARY 

OF FIRST ARMY STOP WEEK OF SIXTEEN JANUARY STOP... 






(2) 

Lug-settings 

: 

1, 

2, 

4, 

6, 

11, 

16. 










(3) 

Wheel-lengths: 

29, 31, 37, 

41, 

43, 47 

(order 

unknown). 

V 

U 

I 

D 

Y 

T Q 

C 

P S 

S 

A 

U B 

T 

A 

Q 

Y 

X I 

G 

Q 

G 

J 

V 

u 

C 

A 

K 

P 

B B 

N 

X L 

E 

F 

I X 

D 

T 

K 

S 

Z A 

M 

G 

U 

L 

N 

z 

D 

S 

K 

W 

J X 

F 

A L 

T 

Z 

E S 

F 

R 

R 

V 

J U 

F 

Z 

W 

0 

E 

K 

0 

U 

H 

L 

U I 

A 

A Q 

Z 

J 

J P 

S 

B 

Q N 

Z G 

E 

Z 

Y 

X 

Y 

V 

B 

B 

D 

T 

J L 

U 

F X 

V 

0 

Z L 

E 

F 

R 

V 

D W 

P 

C 

J 

P 

M 

T 

R 

B 

M 

B 

P V 

P 

V K 

K 

W Q K 

X. 










Given; 


(1) 

Message beginning: * 

'IMPORTANT 

MESSAGE 

FOR 

COMMANDING 






GENERAL STOP.. 

fl 

1 















(2) 

Wheels and 

lugs: 

Wheel 

47 

= 

1 

lug 
















Wheel 

31 

= 

2 

lugs 
















Wheel 

41 

= 

4 

lugs 
















Wheel 

43 

= 

6 

lugs 
















Wheel 

29 

= 

10 lugs 
















Wheel 

37 

= 

16 lugs 






T 

R 

Y 

U 

R 

V C 

K 

Y E 

U 

R 

T C 

K 

U 

V 

A 

V A 

P 

0 

R 

R 

G 

F 

I 

H 

I 

V 

C T 

A 

V N 

W 

H 

J G 

Y 

H 

N 

V 

W Z 

T 

N 

B 

I 

0 

Q 

Y 

R 

0 

F 

Q E 

M 

U F 

H 

E 

N I 

X 

Z 

L 

T 

B I 

U 

D 

S 

A 

M 


SICJP YGPUV. 

67. Given: (1) Four messages "in depth" with lug-settings: 1, 2, 4, 
6, 11, 16. 

(2) Messages begin: "MESSAGE (number) STOP..." 



(3) 

Wheel 

lengths: 

29, 

31, 

, 37, 

41, 

43, 

. 47 

(order unknown). 

No. 1 

- V 

Y 

I 

u 

E 

E 

N 

T 

G 

X 

A 

P 

U 

E 

0 

W 

R 

E 

H 

I 

N 

J 

Y 

B 

c 


V 

C 

I 

B 

H 

M 

P 

W 

F 

C 

G 

w 

0 

W 

S 

F 

X 

B 

X 

T 

U 

P 

G 

E 

N 


M 

F 

S 

R 

V 

Z 

V 

0 

J 

A 

Z 

N 

U 

T 

S 

R 

I 

R 

L 

N 

Q 

G 

J 

0 

G 


J 

G 

F 

S 

A 

A 

R 

Y 

R 

A 

A 

F 

Z 

Z 

U 

F 

F 

A 

N 

G 

F 

T 

X 

X 

X. 

No. 2 

- V 

Y 

I 

U 

E 

E 

N 

S 

S 

Q 

I 

Q 

E 

E 

0 

W 

R 

G 

E 

V 

J 

M 

0 

U 

N 


L 

M 

Y 

G 

L 

N 

W 

Y 

I 

T 

G 

N 

M 

X 

M 

P 

N 

Y 

R 

U 

L 

R 

A 

z 

U 


L 

K 

0 

T 

D 

U 

E 

P 

I 

A 

U 

C 

D 

G 

V 

K 

S 

F 

T 

X. 






No. 3 

- V 

Y 

I 

U 

E 

E 

N 

X 

B Q 

B 

D 

L 

E 

0 

W 

R 

G 

0 

I 

K 

H 

L 

F 

C 


M 

Y 

C 

L 

Y 

W 

D 

W 

H 

A 

F 

Z 

E 

Y 

L 

U 

T 

Z 

C 

N 

U 

X 

X 

X 

X. 
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No. 4-VYIUE ENGGZ PGABD SNFDI AXQNC 

CCYRW VRRIO RGQIV HOURT VRAZU 

BQSPX JLDJE OITLV OSETZ UXXXX. 

68. The following two messages have been intercepted within a few minutes 
of each other. The enemy has been using lug-settings of 1, 2, 4, 6, 


11, 16, and 

wheel- 

■lengths 

of 29 

, 31, 37 

r 41 


43 

, 47 

(order unknown) 

No. 1 - S 

0 

G 

L 

C 

C 

B 

H 

C 

S 

w 

W P 

E 

K 

X 

E 

E 

Q 

E 

M 

C 

J 

0 

J 

W 

N 

P 

F 

G 

D 

Q 

0 

Y 

V 

0 

0 Q 

A 

A 

Y 

I 

Q 

u 

0 

S 

u 

Q 

B 

Q 

T 

A 

N 

W 

I 

T 

F 

R 

V 

I 

Q 

Z K 

S 

C 

C 

I 

K 

p 

X 

F 

c 

S 

I 

U 

K 

E 

C 

U 

Z 

V 

G 

S 

I 

L 

A 

T D 

Z 

U 

S 

G 

T 

V 

U 

A 

T 

H 

W 

P 

X 

L 

I 

Q 

K 

L 

P 

N 

Q 

R 

F 

B V 

Y 

D 

B 

0 

N 

E 

V 

R 

F 

W 

E 

K 

G 

Q 

I 

D 

V 

F 

R 

0 

Y 

K. 















No. 2 - S 

0 

G 

L 

c 

C 

B 

H 

C 

S 

W 

W P 

E 

K 

X 

E 

E 

Q 

E 

M 

C 

J 

0 

J 

N 

Y 

N 

G 

0 

G 

Q X 

C 

I 

M 

Q u 

N 

J 

X 

K 

C 

R 

M 

R 

R 

I 

J 

A 

P 

Z 

0 

N 

I 

W 

z 

T 

I 

N 

C 

K Y 

Q 

L 

F 

T 

M 

D 

T 

E 

T 

0 

A 

V 

T 

Q 

0 

M 

A 

U 

H 

N 

J 

A 

J 

K L 

L 

P 

Z 

T 

Q 

D 

J 

T 

0 

Q 

T 

S 

X 

u 

N 

G 

I 

M 

B 

Y 

P 

S 

0 

F S 

E 

C 

M 

D 

I 

M 

Z 

I 

R 

L 

K 

A 

M 

N 

G 

C 

z 

V 

C 

D 

E 

J 

K 

Q A 

Q 

A. 












69. Message likely begins: "PRIVATE FOR GENERAL ABERNATHY TAYLOR STOP.” 

The enemy has been using the CD-57 with the following wheels and lugs: 


S R J B H 
K 0 I K M 
W X Y T W 
S 0 K V A 
R M Z C C. 


S X B Y J 
Y L S W 0 
L X E B Z 
A E E Q D 


lugs; 

Wheel 

31 

= 

4 

lugs; 

Wheel 

29 = 6 

41 = 

= 16 

lugs. 










C E 

E J 

U 

X 

G 

X 

Q 

C 

R 

0 

R 

I 

Z 

X S 

A Z 

G 

Q w 

K 

Z 

C 

U 

L 

M 

U 

U 

N R 

K B 

J 

N 

B 

H 

C 

G 

R 

I 

Z 

F 

/i 

D N 

0 D 

K 

H 

H 

Y 

D 

W 

W 

M 

X 

C 

0 


70. The following message ends with the words: "SIGNED COMMANDING GENERAL 
FIFTEENTH AIRBORNE STRIKE COMMAND FORCES." 


K E Q X Z 
D Z I K F 
K C C G U 
Z V B B M 
Y A N R O 


P U J U H 
P P R K K 
Y H P G Z 
Z M Q J Y 
R X X X X. 


O U X Q D 
H M S Y F 
K N O R T 
J O E J F 


A Q C P Q 
X J L T S 
N Y F C V 
O E W C V 


F Q E C V 

V E V N B 

Y E V Z O 

E J E T C 
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CHAPTER 11 


FINAL REMARKS 

In this final chapter we shall attempt to cover several things 
concerning the solution of the HAGELIN CRYPTOGRAPH which for one reason or 
the other were not adequately covered in previous chapters. Thus, this 
chapter may perhaps be described as a potpourri of items relating to the 
HAGELIN CRYPTOGAPH. Also, too, this chapter finally provides the author 
with an opportunity to present some of his own thoughts or reflections 
concerning the cryptanalysis of the HAGELIN CRYPTOGRAPH. 

First, we should briefly discuss the particular "unusualness” of 
plaintext which makes up the text of a message enciphered with the Model 
Type C-48 Hagelin machine (M-209). The "unusualness" of this Hagelin 
plaintext is caused by using the letter "z" as a space between words. 
(Enciphering the letter "z" between words causes the plaintext to be 
printed in nomal word-lengths when the message is deciphered.) So 
non-normal in fact is Hagelin plaintext that the mathematical 
approach in the general solution can easily be described as extremely 
effective! Thus, statistical tests used in matching distributions, such 
as the Chi test, are decidedly more accurate than if the text were simply 
normal English text without the letter "z" between words. 

Based on a distribution of 50,000 letters of English military text in 
some 9,619 words with the letter "z" being used as a space between words, 
the average frequencies of 1000 letters are the following: 


A 

- 

62 

J 

- 

1 

S - 

51 

B 

- 

8 

K 

- 

2 

T - 

77 

C 

- 

26 

L 

- 

31 

U - 

22 

D 

- 

35 

M 

- 

21 

V - 

13 

E 

- 

109 

N 

- 

67 

W - 

13 

F 

- 

24 

0 

- 

63 

X - 

4 

G 

- 

14 

P 

- 

22 

Y - 

16 

H 

- 

28 

Q 

- 

3 

Z - 

162 

I 

- 

62 

R 


64 
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By examining these expected frequencies of letters in Hagelin plain¬ 
text, it will be seen that two letters (E and Z) comprise over 25% of the 
text! And, indeed, the six letters, E, N, 0, R, T, and Z, comprise over 
50% of the text! Thus, with the abnormal high-frequency of the letter Z 
especially, one can understand that the statistical tests used in analyz¬ 
ing HAGELIN CRYPTOGRAPH traffic, such as the Chi test, for example, are 
very successful in matching distributions even when the amount of 
available text is somewhat limited. 

Let us turn now briefly to another important subject in the cryptanal¬ 
ysis of the HAGELIN CRYPTOGRAPH. This is the subject of enciphered 
indicators. In the course of this text we have not seriously touched 
upon the various cryptanalytic problems involved when initial wheel- 
settings of messages have been enciphered. Thus, in actual practice it 
is likely that correspondents will have developed or contrived some 
method to encipher the initial wheel-settings of messages * 

With respect to these enciphered indicators, the cryptanalyst will 
likely be faced with the following problems: 

(1) Attempts can be made to put messages "in depth" or to equate 
messages by their indicators, even though the indicators are enciphered. 

In other words, a particular system or method used to encipher the 
indicators may have a serious "flaw" which will still permit the analyst 
to benefit from the indicators in some fashion. Thus, just because the 
indicators have been enciphered does not always mean that the cryptanalyst 
cannot benefit from them. There are weak "indicator enciphering methods" 
just as there are weak "cryptographic systems". 

(2) After solving a HAGELIN CRYPTOGRAPH message the cryptanalyst of 
course is always particularly anxious to "recover" the indicator encipher¬ 
ing method so that thereafter he can "read" all the traffic as easily as 
the correspondents. 

The subject of enciphered indicators can sometimes be as complex as the 
subject of solving the HAGELIN CRYPTOGRAPH — and the reader-student is 
advised that reading one HAGELIN CRYPTOGRAPH message in a particular system 
does not insure that all messages in the system will be read. 

When analyzing and working with enciphered indicators, a very important 
table is the following which shows the relationship between the "wheel- 
settings" as viewed on the face of the machine and the "effective" pin- 
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positions internally within the machine that actually affect operations 
of the machine: 


Wheel 26 

Letter showing: ABCDEFGHIJKLMNOPQRSTUVWXYZ 
Internal pin: PQRSTUVWXYZABCDEFGHIJKLMNO 

Wheel 25 

Letter showing: ABCDEFGHIJKLMNOPQRSTUVXYZ 
Internal pin: OPQRSTUVXYZABCDEFGHIJKLMN 

Wheel 23 

Letter showing: ABCDEFGHIJKLMNOPQRSTUVX 
Internal pin: NOPQRSTUVXABCDEFGHIJKLM 

Wheel 21 

Letter showing: ABCDEFGHIJKLMNOPQRSTU 
Internal pin: MNOPQRSTUABCDEFGHIJKL 

Wheel 19 

Letter showing: ABCDEFGHIJKLMNOPQRS 
Internal pin: LMNOPQRSABCDEFGHIJK 

Wheel 17 

Letter showing: ABCDEFGHIJKLMNOPQ 
Internal pin: KLMNOPQABCDEFGHIJ 

Let us turn now to the word faithl If there is one thing that can be 
said about almost every cryptographic system^ it is that its inventor^ 
its creator, or its backers will have an almost unbelievable amount of 
faith that their system provides the greatest security possible! They 
will very honestly and naturally believe their system is the best. More¬ 
over, it is extremely difficult, if even possible, to dissuade them from 
their beliefs. What often happens is that the cryptanalyst finds a "weak 
spot" in the cryptographic system, and proves the weakness by reading 
perhaps some messages. The creators of the system will still claim the 
invincibility of their system and will perhaps "plug the leak" so-to- 
speak by making a change in their system which may prevent the crypt¬ 
analyst from solving the system in the manner in which he original 
reached a solution. But as you might suspect, a new weakness is either 
introduced into the system, or is found by the cryptanalyst, and the 
system is again solved! Consider now the case of the HAGELIN CRYPTOGRAPH. 
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The original HAGELIN CRYPTOGRAPH consisted of five-wheels. A short 
while later the Model Type C-48 cipher machine (M-209) came into 
existence with six keywheels having respectively 26, 25, 23, 21, 19, and 
17 pins. Then came the more complicated models, to "plug the leaks” so- 
to-speak. Models came into existence, such as the CD-57, with multiple, 
larger wheels, with from 25 to 47 pins per wheel. The number of lugs on 
the machine was increased from 27 to 40; and the concept of the "outer 
alphabet ring” was introduced. The purpose of these various modifications 
was naturally to improve the cryptographic security obtained from the 
system. But note the interesting fact that the newer CD-57 has no over¬ 
laps in the lugs! Here a new weakness is introduced into the system! 

And what of the "backers” of the HAGELIN CRYPTOGRAPH? What is their 
faith in the system? In Appendix I is a letter written by the manufacturer 
of the HAGELIN CRYPTOGRAPH. The letter, written, incidentally, in the 
early 1960*s, is interesting. No doubt the writer of the letter is 
completely sincere, and no doubt a most intelligent invididual. But 
does he really prove the invincibility of the HAGELIN CRYPTOGRAPH? 

But the author does want to be fair! The company manufacturing the 
HAGELIN CRYPTOGRAPH has never said, to the author's knowledge, that the 
HAGELIN CRYPTOGRAPH was or is invincible under all conditions. The 
inherent security provided by the HAGELIN CRYPTOGRAPH is no doubt 
understood by the manufacturer. And, indeed, as a tactical cryptographic 
system where the object of the system is merely to "delay" solution, 
the HAGELIN CRYPTOGRAPH is probably a good system. And there is another 
point to bring out. The year now is 1977. Modern cryptographic 
technology, the use of sub-miniature electronic components, "chips", etc. 
have made systems such as the HAGELIN CRYPTOGRAPH generally obsolete, 
so what we are really talking about is a system that though it is 
probably being used today is gradually disappearing. 
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APPENDIX I 


Effect of computers on the security of 
Hagelin cryptographer type C-52 


The two scientific marvels of our age are the missile and the computer, and 
there are several close parallels between them. Each represents a sudden 
advance which opens whole new fields for exploration and study; both are so 
new that we still cannot guess the magnitude and nature of their influence 
on our civilization. However, amazing as they are, both have predictable, 
technical outer limits. Today man flies around the earth in 90 minutes; he 
will probably fly to the moon in the next few years; but there are few of 
us who visualize manned flight to the outer reaches of the solar system, 
and almost none expect flight beyond the solar system. So it is also with 
computers. The highest operating speeds presently attainable are about 1/33 
the speed of light, which is the maximum velocity of propagation in nature. 
In years to come, this speed will be improved, but almost no one believes 
that the theoretical maximum, the speed of light, will ever be attained in 
practice. 

We are frequently asked by people who are unfamiliar with computers if 
cryptograms enciphered on our machine type C-52 cannot be deciphered with 
the assistance of these "giant brains". It is the purpose of this paper to 
demonstrate for those people that our machines have been designed so as to 
completely defeat the use of computers for this purpose at any stage of 
computer development in the forseeable future, and in fact even at the 
extreme outer technical limit of their potential development. It is of 
course assumed that our machine type C-52 is used in accordance with our 
advice as contained in our brochure 3153. 

In order to decipher a cryptogram which has been enciphered on the machine 
type C-52 with a computer, we must undertake a process somewhat like this: 
Instruct the computer to assemble a combination of the variable elements of 
the machine type C-52, and beginning with some keywheel alignment attempt to 
decipher, say fifty letters of the cryptogram. This probably can be done on 
many computers. Having deciphered the message at our assumed combination of 
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the variable elements it is necessary to provide the computer with some 
form of test to determine whether the resulting text is really intelligible 
text^ since clearly we will be unable to read the trial decipherments at 
the speed which the computer can produce them. How to achieve this on a 
computer is not clear at this time, but let us assume that it is 
achievable. If the first trial does not produce intelligible text, the 
computer will be instructed to try again at the next possible keywheel 
alignment, and so on until all the keywheel alignments have been tried. 

If the text has not been found at this point, the computer must try all 
possible wheel alignments all over again with the new inner settings. 

Sooner or later, the original clear text will appear. There is no 
theoretical obstacle to this process. There are only two sources of 
difficulty: One of these is that the total number of possible combinations 

of the variable elements in the machine type C-52 is so stupendous that in 
the number of false decipherments, many of which will be intelligible text, 
but not the true original message text. The feasibility of identifying the 
correct clear text is doubtful even if the necessary number of trial 
decipherments can be made. We are confronted with the classic problem that 
a large number of monkeys hitting keys on typewriters will ultimately type 
one of Shakespeare's plays. They will also type a fantastic number of 
other intelligible texts in their efforts and who is to say which was 
intended. Nevertheless, let us suppose that some way to overcome this 
difficulty can be found, and consider the second source of difficulty. The 
second source of difficulty is the time required to perform all of the 
necessary trial decipherments. In order to estimate the magnitude of this 
difficulty, we now consider how many trials must be made and how fast they 
can be performed. 

It will be recalled that it is necessary to have the complete inner and 
outer settings of the machine type C-52, and the correct relative position 
of the typewheels, in order to decipher a message. The number of trials 
which our computer must make to ensure finding the correct decipherment of 
a cryptogram is equal to the total available combinations of inner and 
outer settings and relative positions of the typewheels. How many of these 
are there? The machine type C-52 comes equipped with a set of six 
keywheels, each carrying a pin disc. Each pin disc has a different number 
of pins. The number of pins on the wheels in the prime model is 29, 31, 
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37, 41, 43 and 47. The pins on each wheel may be set in either of two 

positions, called "active" and "inactive". Since each pin may be set in 

one of two ways and without regard to any other pin, the 29 wheel, that is, 

29 

the keywheel carrying twenty-nine pins, may be set in any one of 2 

different ways, or over 500,000,000 combinations may be set on this wheel 

alone. Similarly, we can show that: 

31 

The 31 pin disc has 2 combinations or over 2,000,000,000 

37 

The 37 pin disc has 2 combinations or over 100,000,000,000 

41 

The 41 pin disc has 2 combinations or over 2,000,000,000,000 

43 

The 43 pin disc has 2 combinations or over 8,000,000,000,000 

47 

The 47 pin disc has 2 combinations or over 120,000,000,000,000 

Since the selection of the pin settings on one of these keywheels in no way 

restricts the selection on any other wheel, the total number of ways in 

which the pins may be set is actually the product of all of these numbers, 

68 

or approximately 3.7 x 10 which may be written: 

370,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000, 

000 , 000 , 000 , 000 , 000 . 

This of course is based on every possible pin pattern being used. We 

recommend in our brochure 3153 that only patterns be used that have between 

45-55% active pins on each wheel. This highly desirable limitation reduces 

67 

the total n\mber to 1.1 x 10 , an insignificant change in a number of this 

size. It is believed that the computer would have to generate and reject 
these unacceptable patterns, it would not be feasible to completely avoid 
them. Nevertheless let us assume that it can be done. 

The computation of the number of cryptographically different arrangements 
of bar lugs on the drum bars is somewhat complex. Suffice it is to say 
here that there are approximately 65,000 that are in accordance with our 
recommendations. Any one of these, of course, may be used in combination 
with any one of the enormous number of selections of pin settings which 
are possible, each combination being in effect a different machine, 
producing a different key from any other machine. Furthermore, the machine 
type C-52 is so constructed that the keywheels may be inserted into the 
machine in any order you choose. This increases the number of possible 
variations by a factor of 720. The rearrangement of the keywheels, even 
without changing any other element of the machine, will result in the 
generation of a completely different key than that which was produced by 
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the machine in the original arrangement. They are however not independent 
from the patterns of bar lugs on the drum bars, being indeed a much simpler 
method of effecting the same changes. Therefore the number of approximate¬ 
ly 65,000 is the total for both variables. 

Finally we come to the number of outer settings available, consisting of 

the keywheel alignments and the relative position of the two typewheels. 

In the prime model there are 29 x 31 x 37 x 41 x 43 x 47 = 2,756,205,443 

possible keywheel alignments. There are twenty-six possible relative 

positions of the two typewheels, which may be selected without reference to 

the setting of any other element. In all then, the number of possible 

combinations of inner and outer settings is the product of the number of 

67 

settings available for each variable element, or 1.1 x 10 x 65,000 x 

82 

2,756,205,443 x 26 = 5 x 10 . This is the number of trial decipherments 

of the cryptogram our computer must make in order to ensure that the 
correct decipherment is actually performed. 

Let us turn now to the question of how fast we can perform this enormous 
task. In order to do this, it is necessary to touch briefly on the nature 
of large computers. (If additional information is desired, it is readily 
obtainable in literature from all manufacturers of large scale digital 
computers, as well as in the numerous books and articles published about 
computers and computer programming.) Every computer embodies a "memory", 
an "arithmetic" organ, a repertoire of "logical operations", and of course 
a means of getting data into and out of the machine. These components, 
however, are quite insufficient for the computer to be able to solve any 
problem. The so-called "giant brains" for all their speed and manipulative 
ability are incapable of independent thought. In order to get them to do 
the simplest job they must be "programmed" in minute detail by a man who 
knows exactly which steps should be taken under any possible conditions and 
in which order they should be performed. This program, which is introduced 
into the machine before the introduction of the data to be operated on, 
tells the computer where to put each item of data in its memory, what 
operations to perform in turn on each item, where in the memory to store 
the results of operations, and ultimately what items to print as an answer. 
A large percentage of a computer's operations consist of moving things 
around. Indeed, the actual arithmetic operations performed in a computer 
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are themselves achieved by either displacing I’s or 0*s to the right or 
left, or by changing l*s to 0*s or vice versa according to definite 
rules. Each computer is capable of a certain number of basic operations 
such as "add", "subtract", "multiply", "store in memory", "compare" (to 
determine which of two numbers is larger), etc. The important point to 
note is that the problem to be presented to the computer must be reduc¬ 
ible to a great number of simple steps. The computer achieves its 
results not because of omniscience, but because of its ability to per¬ 
form a myriad of simple tasks at prodigious speeds. 

There are both theoretical and practical limits to this speed. One of 
the most frequent commands to be programmed is to shift data into or out 
of the memory. Let us assume a memory location is separated from the 
arithmetic organ by one meter, which would be a minimal distance. In 
that event the shortest time in which the entry within that location 
could possibly get to the arithmetic organ is 1/3000,000,000 of a second. 
This is because the maximum velocity of propagation in nature, the speed 
of light, is approximately 300,000,000 meters per second. In actuality, 
the time required to get an item out of one location and into another is 
far longer than this. A speed of 1/8,000,000 of a second is about the 
highest presently attainable. For our purposes we will suppose that our 
computer operates at the speed of light, since in no case can any greater 
speed be attained. If the machine type C-52 is proof against this, we 
may be sure it is safe from any computer which may ever be built. 

The computer must now be programmed so that it can simulate the machine 
type C-52 and decipher the cryptogram at high speed for each combination 
of the variable elements. It must also be programmed to proceed system¬ 
atically through every possible combination of variable elements. Each 
trial decipherment of our cryptogram if it is only fifty letters long 
will certainly require several hundred steps in our program. Each trial 
decipherment must then be tested to determine if it is acceptably intel¬ 
ligible text. This will additionally require a great number of steps in 
our program. The exact number of steps will depend on the design of the 
computer and the skill of the programmer. If we demonstrate that the 
time required to decipher our cryptogram is too great even if each trial 
decipherment and test for intelligibility could be performed in one step 
and each step at the speed of light moving one meter (so that 300,000,000 
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trial decipherments and tests for intelligibility could be made in a 
second ), then it is clear that the time for decipherment and testing 
would be too great for any conceivable computer in existence. 

If our computer can make 300,000,000 trial decipherments and tests per 
second, then it can make — 

300,000,000 per second x 60 = 18,000,000,000 per minute 

18,000,000,000 per minute x 60 = 1,080,000,000,000 per hour 

1,080,000,000,000 per hour x 24 = 25,920,000,000,000 per day 

25,920,000,000,000 per day x 365 = 946,080,000,000,000 per year 

If we divide this last figure, the number of trial decipherments which 

can be made in a year, into the niimber of combinations of the inner and 

outer variables given above, we will have the absolute minimum number of 

years required to ensure the correct decipherment of our cryptogram. 

67 

The answer so obtained is approximately 5 x 10 years. If you hope at 

random to hit the correct answer by the time you go halfway, then the 

67 

number is only 2.5 x 10 years. This is after the fantastic concessions 
we have made to the speed and capabilities of these "giant brains". 

Either of these figures is clearly greatly in excess of the age of the 
earth. In fact, it is difficult even in this day and age to conceive of 
them. As is well known, time on computers is an extremely expensive 
item. Costs in excess of 1,000 Swiss francs an hour are not unusual. If 
you could buy computer time at a Swiss franc a year, the cost of exhaust¬ 
ively testing every combination of variable elements on our machine type 
C-52 would be beyond imagination. 

Further, we are not trying to deprecate the great value of the computer 
to our modern civilization. We are not trying to deny that computers 
must be of great value to cryptanalysts. Their ability to handle great 
masses of data rapidly must make them a very valuable tool. But it must 
always be remembered that they do not think independently, and are tools 
indeed. 

If one evaluates realistically the various ways by which an enemy can 
successfully recover a cryptographic usage, one is forced to the conclu¬ 
sion that by far the greatest source of danger is from unauthorized 
access to cryptographic instructions, key lists, and related documents. 
This can be achieved at any of a number of points; at the time of the 
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original drafting of the cryptographic documents, during their printing, 
during their forwarding, during their storage, or during their use. This 
may be with or without the collaboration of trusted personnel. In this 
day of ideologies the trustworthiness of personnel presents a serious 
problem. When one fully appreciates the limitations and costs of 
computer analysis, and considers what the expenditure of far less effort 
and cost could probably achieve in securing unauthorized access, one can 
appreciate the relative probabilities of the two attacks. 

Far less dangerous than unauthorized access but next in magnitude of 
danger are poorly designed usages and errors committed by code clerks. 

The first can be avoided by a careful study of our brochure 3153. The 
second depends on the quality and experience of the code clerks. 

When one considers all factors, it is clear that compared to the other 
threats to all cryptographic usages, the danger from computers can be 
considered insignificant. 
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